3ea749bfca6930f84b4e043fb73465d61e5dfbeb16d0f922004d61306523104f

Analysis

max time kernel
119s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2024, 20:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b41cfacdfcd4b2863d162ff0a1310e20N.exe
Size

468KB
MD5

b41cfacdfcd4b2863d162ff0a1310e20
SHA1

82b6a403b98f543da96b3c77030c0af42c015bf9
SHA256

3ea749bfca6930f84b4e043fb73465d61e5dfbeb16d0f922004d61306523104f
SHA512

e60b1b93fa20f51549ad74570be477c9902e1d09982f3af323639bb9c9fa2aac06f13c6291fbac6cccefea00bf121bc5490af52c120fd599b331c2a2c9e18117
SSDEEP

3072:KbCGog/nI95UtFYiPAtjcf8/qCdSCzgpacDHeGVfYGLX8mpQukGlD:KbnoJ7UtbPsjcfCcEhGLsKQuk

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1492	Unicorn-26097.exe
2388	Unicorn-43585.exe
4732	Unicorn-19635.exe
2404	Unicorn-7788.exe
2948	Unicorn-49376.exe
4856	Unicorn-63111.exe
2892	Unicorn-15717.exe
4624	Unicorn-32075.exe
3652	Unicorn-32075.exe
3588	Unicorn-1348.exe
4456	Unicorn-48503.exe
4084	Unicorn-34767.exe
4176	Unicorn-54368.exe
2284	Unicorn-57155.exe
4980	Unicorn-46941.exe
5064	Unicorn-28951.exe
3556	Unicorn-20783.exe
3680	Unicorn-55593.exe
2544	Unicorn-35727.exe
4376	Unicorn-60232.exe
1684	Unicorn-21337.exe
3156	Unicorn-26548.exe
2320	Unicorn-17882.exe
4712	Unicorn-26813.exe
764	Unicorn-16598.exe
4764	Unicorn-18007.exe
2348	Unicorn-13922.exe
4492	Unicorn-38162.exe
4480	Unicorn-18561.exe
872	Unicorn-22453.exe
4816	Unicorn-28697.exe
4888	Unicorn-45033.exe
420	Unicorn-55147.exe
780	Unicorn-471.exe
444	Unicorn-51618.exe
4304	Unicorn-59231.exe
236	Unicorn-48163.exe
724	Unicorn-14114.exe
4568	Unicorn-38619.exe
5112	Unicorn-34535.exe
3672	Unicorn-3543.exe
4548	Unicorn-20236.exe
3008	Unicorn-24229.exe
1312	Unicorn-20145.exe
3248	Unicorn-56132.exe
3100	Unicorn-36573.exe
2128	Unicorn-21467.exe
3432	Unicorn-50871.exe
3884	Unicorn-33357.exe
992	Unicorn-37995.exe
3232	Unicorn-53777.exe
784	Unicorn-53777.exe
5008	Unicorn-10798.exe
2896	Unicorn-54332.exe
5000	Unicorn-26372.exe
5004	Unicorn-29172.exe
1028	Unicorn-37341.exe
212	Unicorn-23627.exe
4200	Unicorn-9328.exe
816	Unicorn-5152.exe
2352	Unicorn-42655.exe
1408	Unicorn-25573.exe
3688	Unicorn-15358.exe
4292	Unicorn-63076.exe

Program crash 8 IoCs

pid	pid_target	Process	procid_target
7164	5316	WerFault.exe	187
7560	5148	WerFault.exe	215
9868	5040	WerFault.exe	418
15932	16192	WerFault.exe	795
17104	16612	WerFault.exe	824
16108	17104	WerFault.exe	857
16896	15772	WerFault.exe	781
17248	15964	WerFault.exe	791

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24229.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46739.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20778.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58001.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51976.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57036.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47611.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37228.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51971.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22478.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16641.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43747.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6159.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39957.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2075.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12246.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24730.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53803.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17919.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-819.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34679.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21930.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54742.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55614.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41887.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36999.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13403.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20549.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55593.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31793.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21847.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19216.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55147.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24259.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57036.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37996.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23605.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27254.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12718.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26720.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32285.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50347.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44229.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64075.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42402.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51167.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57036.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44191.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	Process not Found

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Process not Found

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	8964	Process not Found
Token: SeChangeNotifyPrivilege	8964	Process not Found
Token: 33	8964	Process not Found
Token: SeIncBasePriorityPrivilege	8964	Process not Found

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1280	b41cfacdfcd4b2863d162ff0a1310e20N.exe
1492	Unicorn-26097.exe
4732	Unicorn-19635.exe
2388	Unicorn-43585.exe
2404	Unicorn-7788.exe
4856	Unicorn-63111.exe
2948	Unicorn-49376.exe
2892	Unicorn-15717.exe
4624	Unicorn-32075.exe
3588	Unicorn-1348.exe
3652	Unicorn-32075.exe
4176	Unicorn-54368.exe
4084	Unicorn-34767.exe
4456	Unicorn-48503.exe
2284	Unicorn-57155.exe
4980	Unicorn-46941.exe
5064	Unicorn-28951.exe
3680	Unicorn-55593.exe
3556	Unicorn-20783.exe
2544	Unicorn-35727.exe
4376	Unicorn-60232.exe
3156	Unicorn-26548.exe
764	Unicorn-16598.exe
4712	Unicorn-26813.exe
1684	Unicorn-21337.exe
2320	Unicorn-17882.exe
4764	Unicorn-18007.exe
2348	Unicorn-13922.exe
4480	Unicorn-18561.exe
4492	Unicorn-38162.exe
872	Unicorn-22453.exe
4816	Unicorn-28697.exe
4888	Unicorn-45033.exe
420	Unicorn-55147.exe
780	Unicorn-471.exe
444	Unicorn-51618.exe
4304	Unicorn-59231.exe
236	Unicorn-48163.exe
724	Unicorn-14114.exe
3008	Unicorn-24229.exe
4568	Unicorn-38619.exe
3672	Unicorn-3543.exe
5112	Unicorn-34535.exe
4548	Unicorn-20236.exe
3248	Unicorn-56132.exe
1312	Unicorn-20145.exe
3100	Unicorn-36573.exe
2128	Unicorn-21467.exe
3432	Unicorn-50871.exe
3884	Unicorn-33357.exe
992	Unicorn-37995.exe
3232	Unicorn-53777.exe
784	Unicorn-53777.exe
2896	Unicorn-54332.exe
5008	Unicorn-10798.exe
5000	Unicorn-26372.exe
5004	Unicorn-29172.exe
1028	Unicorn-37341.exe
212	Unicorn-23627.exe
816	Unicorn-5152.exe
4200	Unicorn-9328.exe
2352	Unicorn-42655.exe
4292	Unicorn-63076.exe
1408	Unicorn-25573.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 1492	1280	b41cfacdfcd4b2863d162ff0a1310e20N.exe	89
PID 1280 wrote to memory of 1492	1280	b41cfacdfcd4b2863d162ff0a1310e20N.exe	89
PID 1280 wrote to memory of 1492	1280	b41cfacdfcd4b2863d162ff0a1310e20N.exe	89
PID 1492 wrote to memory of 2388	1492	Unicorn-26097.exe	92
PID 1492 wrote to memory of 2388	1492	Unicorn-26097.exe	92
PID 1492 wrote to memory of 2388	1492	Unicorn-26097.exe	92
PID 1280 wrote to memory of 4732	1280	b41cfacdfcd4b2863d162ff0a1310e20N.exe	93
PID 1280 wrote to memory of 4732	1280	b41cfacdfcd4b2863d162ff0a1310e20N.exe	93
PID 1280 wrote to memory of 4732	1280	b41cfacdfcd4b2863d162ff0a1310e20N.exe	93
PID 2388 wrote to memory of 2404	2388	Unicorn-43585.exe	95
PID 2388 wrote to memory of 2404	2388	Unicorn-43585.exe	95
PID 2388 wrote to memory of 2404	2388	Unicorn-43585.exe	95
PID 1492 wrote to memory of 2948	1492	Unicorn-26097.exe	96
PID 1492 wrote to memory of 2948	1492	Unicorn-26097.exe	96
PID 1492 wrote to memory of 2948	1492	Unicorn-26097.exe	96
PID 1280 wrote to memory of 4856	1280	b41cfacdfcd4b2863d162ff0a1310e20N.exe	97
PID 1280 wrote to memory of 4856	1280	b41cfacdfcd4b2863d162ff0a1310e20N.exe	97
PID 1280 wrote to memory of 4856	1280	b41cfacdfcd4b2863d162ff0a1310e20N.exe	97
PID 4732 wrote to memory of 2892	4732	Unicorn-19635.exe	100
PID 4732 wrote to memory of 2892	4732	Unicorn-19635.exe	100
PID 4732 wrote to memory of 2892	4732	Unicorn-19635.exe	100
PID 2404 wrote to memory of 4624	2404	Unicorn-7788.exe	101
PID 2404 wrote to memory of 4624	2404	Unicorn-7788.exe	101
PID 2404 wrote to memory of 4624	2404	Unicorn-7788.exe	101
PID 4856 wrote to memory of 3652	4856	Unicorn-63111.exe	102
PID 4856 wrote to memory of 3652	4856	Unicorn-63111.exe	102
PID 4856 wrote to memory of 3652	4856	Unicorn-63111.exe	102
PID 2948 wrote to memory of 3588	2948	Unicorn-49376.exe	103
PID 2948 wrote to memory of 3588	2948	Unicorn-49376.exe	103
PID 2948 wrote to memory of 3588	2948	Unicorn-49376.exe	103
PID 1492 wrote to memory of 4456	1492	Unicorn-26097.exe	105
PID 1492 wrote to memory of 4456	1492	Unicorn-26097.exe	105
PID 1492 wrote to memory of 4456	1492	Unicorn-26097.exe	105
PID 2388 wrote to memory of 4084	2388	Unicorn-43585.exe	104
PID 2388 wrote to memory of 4084	2388	Unicorn-43585.exe	104
PID 2388 wrote to memory of 4084	2388	Unicorn-43585.exe	104
PID 1280 wrote to memory of 4176	1280	b41cfacdfcd4b2863d162ff0a1310e20N.exe	106
PID 1280 wrote to memory of 4176	1280	b41cfacdfcd4b2863d162ff0a1310e20N.exe	106
PID 1280 wrote to memory of 4176	1280	b41cfacdfcd4b2863d162ff0a1310e20N.exe	106
PID 2892 wrote to memory of 2284	2892	Unicorn-15717.exe	107
PID 2892 wrote to memory of 2284	2892	Unicorn-15717.exe	107
PID 2892 wrote to memory of 2284	2892	Unicorn-15717.exe	107
PID 4732 wrote to memory of 4980	4732	Unicorn-19635.exe	108
PID 4732 wrote to memory of 4980	4732	Unicorn-19635.exe	108
PID 4732 wrote to memory of 4980	4732	Unicorn-19635.exe	108
PID 3588 wrote to memory of 5064	3588	Unicorn-1348.exe	109
PID 3588 wrote to memory of 5064	3588	Unicorn-1348.exe	109
PID 3588 wrote to memory of 5064	3588	Unicorn-1348.exe	109
PID 3652 wrote to memory of 3556	3652	Unicorn-32075.exe	110
PID 3652 wrote to memory of 3556	3652	Unicorn-32075.exe	110
PID 3652 wrote to memory of 3556	3652	Unicorn-32075.exe	110
PID 4624 wrote to memory of 3680	4624	Unicorn-32075.exe	111
PID 4624 wrote to memory of 3680	4624	Unicorn-32075.exe	111
PID 4624 wrote to memory of 3680	4624	Unicorn-32075.exe	111
PID 2948 wrote to memory of 2544	2948	Unicorn-49376.exe	112
PID 2948 wrote to memory of 2544	2948	Unicorn-49376.exe	112
PID 2948 wrote to memory of 2544	2948	Unicorn-49376.exe	112
PID 2404 wrote to memory of 4376	2404	Unicorn-7788.exe	113
PID 2404 wrote to memory of 4376	2404	Unicorn-7788.exe	113
PID 2404 wrote to memory of 4376	2404	Unicorn-7788.exe	113
PID 4856 wrote to memory of 1684	4856	Unicorn-63111.exe	114
PID 4856 wrote to memory of 1684	4856	Unicorn-63111.exe	114
PID 4856 wrote to memory of 1684	4856	Unicorn-63111.exe	114
PID 1492 wrote to memory of 3156	1492	Unicorn-26097.exe	115

C:\Users\Admin\AppData\Local\Temp\b41cfacdfcd4b2863d162ff0a1310e20N.exe
"C:\Users\Admin\AppData\Local\Temp\b41cfacdfcd4b2863d162ff0a1310e20N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26097.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26097.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43585.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43585.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7788.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32075.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55593.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28697.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5152.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55313.exe
        9⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21977.exe
        10⤵
        
        PID:7496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59937.exe
        11⤵
        
        PID:14396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24363.exe
        10⤵
        
        PID:10872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21300.exe
        10⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16465.exe
        10⤵
        
        PID:16212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46739.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15925.exe
        9⤵
        
        PID:13684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61706.exe
        9⤵
        
        PID:15944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25141.exe
        8⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15755.exe
        9⤵
        
        PID:7660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8302.exe
        10⤵
        
        PID:10244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14546.exe
        10⤵
        
        PID:16096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42080.exe
        10⤵
        
        PID:16796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57036.exe
        9⤵
        
        PID:11208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32750.exe
        9⤵
        
        PID:16332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10776.exe
        8⤵
        
        PID:8400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17897.exe
        8⤵
        
        PID:11316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45299.exe
        8⤵
        
        PID:16920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42655.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16419.exe
        8⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58925.exe
        9⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52760.exe
        10⤵
        
        PID:11344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19162.exe
        10⤵
        
        PID:16476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33570.exe
        10⤵
        
        PID:16708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38955.exe
        10⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34669.exe
        9⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8472.exe
        9⤵
        
        PID:15900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23605.exe
        9⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51015.exe
        8⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52729.exe
        9⤵
        
        PID:15852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25656.exe
        8⤵
        
        PID:13320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46867.exe
        8⤵
        
        PID:16772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38877.exe
        7⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50565.exe
        8⤵
        
        PID:7636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34831.exe
        9⤵
        
        PID:16236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57664.exe
        9⤵
        
        PID:17144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25014.exe
        9⤵
        
        PID:8
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57036.exe
        8⤵
        
        PID:10984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21300.exe
        8⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17810.exe
        8⤵
        
        PID:1356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16641.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33736.exe
        7⤵
        
        PID:11724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28763.exe
        7⤵
        
        PID:16904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15358.exe
        6⤵
        Executes dropped EXE
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49091.exe
        7⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11478.exe
        8⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39517.exe
        9⤵
        
        PID:13544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39957.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:16444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25014.exe
        9⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60388.exe
        8⤵
        
        PID:10544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3812.exe
        8⤵
        
        PID:15320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62386.exe
        7⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8302.exe
        8⤵
        
        PID:10324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40647.exe
        8⤵
        
        PID:14568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10523.exe
        8⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29930.exe
        7⤵
        
        PID:10816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14337.exe
        7⤵
        
        PID:16276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10507.exe
        6⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5148 -s 720
        7⤵
        Program crash
        
        PID:7560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46871.exe
        6⤵
        
        PID:8564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19289.exe
        7⤵
        
        PID:15044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17201.exe
        6⤵
        
        PID:11760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45829.exe
        6⤵
        
        PID:16876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9619.exe
        6⤵
        
        PID:16552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60232.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50871.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54545.exe
        7⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37607.exe
        8⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12246.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32807.exe
        10⤵
        
        PID:9356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59954.exe
        10⤵
        
        PID:17220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5889.exe
        9⤵
        
        PID:10760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21300.exe
        9⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27215.exe
        9⤵
        
        PID:13036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60440.exe
        8⤵
        
        PID:8616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36537.exe
        8⤵
        
        PID:12380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58048.exe
        8⤵
        
        PID:16992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18125.exe
        7⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17675.exe
        8⤵
        
        PID:8452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50788.exe
        8⤵
        
        PID:12236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46703.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23605.exe
        8⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22506.exe
        7⤵
        
        PID:11064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54674.exe
        7⤵
        
        PID:15964
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15964 -s 460
        8⤵
        Program crash
        
        PID:17248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-824.exe
        7⤵
        
        PID:16268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5899.exe
        6⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40129.exe
        7⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58105.exe
        8⤵
        
        PID:9436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59916.exe
        8⤵
        
        PID:11228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25916.exe
        8⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
        7⤵
        
        PID:9680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51696.exe
        7⤵
        
        PID:15160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57499.exe
        7⤵
        
        PID:16976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29955.exe
        7⤵
        
        PID:17048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61409.exe
        6⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58105.exe
        7⤵
        
        PID:9460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59916.exe
        7⤵
        
        PID:13652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14990.exe
        7⤵
        
        PID:16724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50229.exe
        7⤵
        
        PID:2476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31582.exe
        6⤵
        
        PID:8520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20441.exe
        7⤵
        
        PID:16316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65205.exe
        6⤵
        
        PID:14536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36573.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56491.exe
        6⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25931.exe
        7⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25843.exe
        8⤵
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59340.exe
        8⤵
        
        PID:12264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6866.exe
        8⤵
        
        PID:16220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50300.exe
        7⤵
        
        PID:9724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20969.exe
        7⤵
        
        PID:15148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12095.exe
        7⤵
        
        PID:1348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18125.exe
        6⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38095.exe
        7⤵
        
        PID:9348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15104.exe
        7⤵
        
        PID:15124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1779.exe
        7⤵
        
        PID:15144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38553.exe
        7⤵
        
        PID:13740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3377.exe
        6⤵
        
        PID:880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38947.exe
        6⤵
        
        PID:15036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31233.exe
        6⤵
        
        PID:16484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21415.exe
        5⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1234.exe
        6⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56569.exe
        7⤵
        
        PID:8672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59340.exe
        7⤵
        
        PID:12228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37996.exe
        7⤵
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30376.exe
        6⤵
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23108.exe
        6⤵
        
        PID:14996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61898.exe
        6⤵
        
        PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58609.exe
        5⤵
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54623.exe
        6⤵
        
        PID:7616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3149.exe
        6⤵
        
        PID:13260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1789.exe
        6⤵
        
        PID:16740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30309.exe
        5⤵
        
        PID:9936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54661.exe
        5⤵
        
        PID:13968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20540.exe
        5⤵
        
        PID:2756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34767.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22453.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23627.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8250.exe
        7⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36127.exe
        8⤵
        
        PID:8292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65317.exe
        8⤵
        
        PID:11272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40211.exe
        7⤵
        
        PID:8600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31302.exe
        7⤵
        
        PID:12060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58582.exe
        6⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58001.exe
        7⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54789.exe
        8⤵
        
        PID:9664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3891.exe
        8⤵
        
        PID:15156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10624.exe
        8⤵
        
        PID:15932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60465.exe
        7⤵
        
        PID:10564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65117.exe
        7⤵
        
        PID:16112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47752.exe
        6⤵
        
        PID:8916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-622.exe
        7⤵
        
        PID:12080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39957.exe
        7⤵
        
        PID:16512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41350.exe
        7⤵
        
        PID:15548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5724.exe
        6⤵
        
        PID:12436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58120.exe
        6⤵
        
        PID:17024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9328.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36599.exe
        6⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16523.exe
        7⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        8⤵
        
        PID:10568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60274.exe
        8⤵
        
        PID:15924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25628.exe
        7⤵
        
        PID:12316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44217.exe
        6⤵
        
        PID:9104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13403.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28526.exe
        6⤵
        
        PID:13000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37228.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24499.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53803.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60274.exe
        7⤵
        
        PID:15944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65380.exe
        7⤵
        
        PID:17012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36999.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-185.exe
        5⤵
        
        PID:8692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31157.exe
        6⤵
        
        PID:14456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34267.exe
        5⤵
        
        PID:11512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24298.exe
        5⤵
        
        PID:16864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16598.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38619.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44431.exe
        6⤵
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19325.exe
        7⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-980.exe
        8⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42667.exe
        9⤵
        
        PID:11752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39775.exe
        8⤵
        
        PID:10732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1482.exe
        8⤵
        
        PID:15816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        7⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42951.exe
        7⤵
        
        PID:12200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41904.exe
        7⤵
        
        PID:16684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56155.exe
        7⤵
        
        PID:17256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1789.exe
        6⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47825.exe
        7⤵
        
        PID:8224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25628.exe
        7⤵
        
        PID:12680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65012.exe
        7⤵
        
        PID:17220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51976.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48493.exe
        6⤵
        
        PID:8360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53476.exe
        6⤵
        
        PID:13288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34679.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48489.exe
        6⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57555.exe
        7⤵
        
        PID:7960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe
        8⤵
        
        PID:14352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29651.exe
        8⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4126.exe
        8⤵
        
        PID:16704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25628.exe
        7⤵
        
        PID:12024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19111.exe
        7⤵
        
        PID:16708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23605.exe
        7⤵
        
        PID:5608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34757.exe
        6⤵
        
        PID:8652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37881.exe
        6⤵
        
        PID:2080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64820.exe
        6⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31299.exe
        6⤵
        
        PID:13000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31860.exe
        5⤵
        
        PID:6588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8354.exe
        6⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31741.exe
        7⤵
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25628.exe
        6⤵
        
        PID:12128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17409.exe
        5⤵
        
        PID:7792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44811.exe
        5⤵
        
        PID:11984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34101.exe
        5⤵
        
        PID:17228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3543.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36071.exe
        5⤵
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60741.exe
        6⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57555.exe
        7⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41463.exe
        8⤵
        
        PID:14596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9807.exe
        8⤵
        
        PID:16944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25628.exe
        7⤵
        
        PID:12308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55282.exe
        7⤵
        
        PID:16888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12696.exe
        6⤵
        
        PID:9968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12304.exe
        6⤵
        
        PID:15116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20549.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52936.exe
        5⤵
        
        PID:6672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15536.exe
        6⤵
        
        PID:8796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54872.exe
        6⤵
        
        PID:12824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58955.exe
        6⤵
        
        PID:15140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61897.exe
        5⤵
        
        PID:9844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64934.exe
        5⤵
        
        PID:13856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46131.exe
        6⤵
        
        PID:1340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16834.exe
      4⤵
      PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31577.exe
        5⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31489.exe
        6⤵
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6413.exe
        7⤵
        
        PID:15520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42785.exe
        7⤵
        
        PID:17044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25628.exe
        6⤵
        
        PID:12196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27690.exe
        6⤵
        
        PID:4048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30481.exe
        5⤵
        
        PID:9412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59069.exe
        5⤵
        
        PID:14092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12717.exe
      4⤵
      PID:6260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13616.exe
        5⤵
        
        PID:7744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40529.exe
        6⤵
        
        PID:11524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38291.exe
        6⤵
        
        PID:14644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37996.exe
        6⤵
        
        PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57036.exe
        5⤵
        
        PID:11036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44191.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51677.exe
      4⤵
      PID:8260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64021.exe
        5⤵
        
        PID:13660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29651.exe
        5⤵
        
        PID:17264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
        5⤵
        
        PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64075.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47743.exe
      4⤵
      PID:16780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49376.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49376.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1348.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28951.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45033.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25573.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45007.exe
        8⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50565.exe
        9⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe
        10⤵
        
        PID:11544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38291.exe
        10⤵
        
        PID:15140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35858.exe
        10⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57036.exe
        9⤵
        
        PID:9540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32750.exe
        9⤵
        
        PID:16232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40779.exe
        9⤵
        
        PID:688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46739.exe
        8⤵
        
        PID:9248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64934.exe
        8⤵
        
        PID:13864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61792.exe
        8⤵
        
        PID:17264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56444.exe
        7⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51333.exe
        8⤵
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14410.exe
        9⤵
        
        PID:15980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10624.exe
        9⤵
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25628.exe
        8⤵
        
        PID:10948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25926.exe
        8⤵
        
        PID:17400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46355.exe
        7⤵
        
        PID:8372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43746.exe
        7⤵
        
        PID:11420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63076.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43637.exe
        7⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58001.exe
        8⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40015.exe
        9⤵
        
        PID:9384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48624.exe
        9⤵
        
        PID:14896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43688.exe
        9⤵
        
        PID:17244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-497.exe
        8⤵
        
        PID:10292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54383.exe
        8⤵
        
        PID:14692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16771.exe
        8⤵
        
        PID:17172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16465.exe
        8⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26999.exe
        7⤵
        
        PID:8064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40887.exe
        8⤵
        
        PID:13936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27897.exe
        8⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24084.exe
        8⤵
        
        PID:12408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46651.exe
        7⤵
        
        PID:11688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4642.exe
        6⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34037.exe
        7⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62895.exe
        8⤵
        
        PID:11952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55168.exe
        8⤵
        
        PID:16612
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16612 -s 76
        9⤵
        Program crash
        
        PID:17104
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 17104 -s 580
        10⤵
        Program crash
        
        PID:16108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5993.exe
        8⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7295.exe
        7⤵
        
        PID:10484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3812.exe
        7⤵
        
        PID:14992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48650.exe
        7⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37996.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22672.exe
        6⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34669.exe
        7⤵
        
        PID:9648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8472.exe
        7⤵
        
        PID:15840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
        7⤵
        
        PID:768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41521.exe
        6⤵
        
        PID:10416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54674.exe
        6⤵
        
        PID:16076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51615.exe
        6⤵
        
        PID:16248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-471.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17213.exe
        6⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27493.exe
        7⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42973.exe
        8⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13948.exe
        9⤵
        
        PID:9904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28011.exe
        9⤵
        
        PID:15056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25014.exe
        9⤵
        
        PID:15560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30585.exe
        8⤵
        
        PID:10408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8472.exe
        8⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20549.exe
        8⤵
        
        PID:16208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24259.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41197.exe
        7⤵
        
        PID:12596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6159.exe
        7⤵
        
        PID:2428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18125.exe
        6⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40015.exe
        7⤵
        
        PID:9376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48624.exe
        7⤵
        
        PID:14904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13777.exe
        7⤵
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe
        6⤵
        
        PID:10112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53258.exe
        6⤵
        
        PID:14156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13426.exe
        6⤵
        
        PID:16076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61582.exe
        6⤵
        
        PID:12404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36163.exe
        5⤵
        
        PID:1644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56657.exe
        6⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57555.exe
        7⤵
        
        PID:7904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31759.exe
        8⤵
        
        PID:12268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45412.exe
        8⤵
        
        PID:16840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
        8⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25628.exe
        7⤵
        
        PID:12112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2844.exe
        7⤵
        
        PID:17372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34757.exe
        6⤵
        
        PID:8468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8716.exe
        6⤵
        
        PID:11672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55282.exe
        6⤵
        
        PID:17380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2075.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56200.exe
        5⤵
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8354.exe
        6⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2625.exe
        7⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30768.exe
        7⤵
        
        PID:3264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29215.exe
        6⤵
        
        PID:12280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36039.exe
        6⤵
        
        PID:16740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57622.exe
        6⤵
        
        PID:17012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45693.exe
        5⤵
        
        PID:7444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9086.exe
        6⤵
        
        PID:16460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28275.exe
        5⤵
        
        PID:13308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47147.exe
        5⤵
        
        PID:16720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35727.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34535.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44431.exe
        6⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19325.exe
        7⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55199.exe
        8⤵
        
        PID:9452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8385.exe
        8⤵
        
        PID:13328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10624.exe
        8⤵
        
        PID:17136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39609.exe
        7⤵
        
        PID:9552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56931.exe
        7⤵
        
        PID:13912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6159.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8011.exe
        6⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47057.exe
        7⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13948.exe
        8⤵
        
        PID:9964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28011.exe
        8⤵
        
        PID:15064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5993.exe
        8⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51006.exe
        7⤵
        
        PID:10540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8472.exe
        7⤵
        
        PID:15760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9137.exe
        7⤵
        
        PID:5300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63677.exe
        6⤵
        
        PID:7188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48816.exe
        6⤵
        
        PID:12612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16205.exe
        5⤵
        
        PID:4076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21847.exe
        6⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32091.exe
        7⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50835.exe
        8⤵
        
        PID:11484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54436.exe
        8⤵
        
        PID:16580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57036.exe
        7⤵
        
        PID:11008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21300.exe
        7⤵
        
        PID:5608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29713.exe
        6⤵
        
        PID:8584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52096.exe
        7⤵
        
        PID:3460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18638.exe
        6⤵
        
        PID:12568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38204.exe
        6⤵
        
        PID:17060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44578.exe
        6⤵
        
        PID:16864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31860.exe
        5⤵
        
        PID:6572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18251.exe
        6⤵
        
        PID:9100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22391.exe
        6⤵
        
        PID:13380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
        6⤵
        
        PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2225.exe
        5⤵
        
        PID:9852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54131.exe
        5⤵
        
        PID:11324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20236.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36071.exe
        5⤵
        
        PID:3840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21847.exe
        6⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57555.exe
        7⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25628.exe
        7⤵
        
        PID:12660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6159.exe
        7⤵
        
        PID:5620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34757.exe
        6⤵
        
        PID:8220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47611.exe
        6⤵
        
        PID:12008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52936.exe
        5⤵
        
        PID:6664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19621.exe
        6⤵
        
        PID:9028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40865.exe
        6⤵
        
        PID:13108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24144.exe
        6⤵
        
        PID:17244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23605.exe
        6⤵
        
        PID:7084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22506.exe
        5⤵
        
        PID:11072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54674.exe
        5⤵
        
        PID:16116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56226.exe
      4⤵
      PID:3800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21847.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58105.exe
        6⤵
        
        PID:9976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5182.exe
        6⤵
        
        PID:15104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32802.exe
        6⤵
        
        PID:16672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63395.exe
        6⤵
        
        PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
        5⤵
        
        PID:9700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28342.exe
        5⤵
        
        PID:14044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17539.exe
        5⤵
        
        PID:16688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29060.exe
      4⤵
      PID:6596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59283.exe
        5⤵
        
        PID:5040
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 464
        6⤵
        Program crash
        
        PID:9868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42811.exe
        5⤵
        
        PID:13404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20930.exe
        5⤵
        
        PID:17228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3667.exe
      4⤵
      PID:9916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54661.exe
      4⤵
      PID:14016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48503.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48503.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37341.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28863.exe
        5⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50565.exe
        6⤵
        
        PID:7624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57036.exe
        6⤵
        
        PID:10992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21300.exe
        6⤵
        
        PID:16356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6928.exe
        6⤵
        
        PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46739.exe
        5⤵
        
        PID:9264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25656.exe
        5⤵
        
        PID:12304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44742.exe
      4⤵
      PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32283.exe
        5⤵
        
        PID:7348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8302.exe
        6⤵
        
        PID:10360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56984.exe
        6⤵
        
        PID:15112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20060.exe
        6⤵
        
        PID:17268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23605.exe
        6⤵
        
        PID:11948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28099.exe
        5⤵
        
        PID:10800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22478.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24504.exe
      4⤵
      PID:8244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40253.exe
        5⤵
        
        PID:15944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23615.exe
      4⤵
      PID:12184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33769.exe
      4⤵
      PID:16724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20540.exe
      4⤵
      PID:6864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26548.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26548.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59231.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7674.exe
        5⤵
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11156.exe
        6⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35359.exe
        7⤵
        
        PID:7948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36253.exe
        8⤵
        
        PID:11904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54436.exe
        8⤵
        
        PID:16568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15924.exe
        7⤵
        
        PID:11656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65117.exe
        7⤵
        
        PID:16248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-549.exe
        6⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13564.exe
        7⤵
        
        PID:9224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29765.exe
        7⤵
        
        PID:14572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53693.exe
        7⤵
        
        PID:13036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8586.exe
        6⤵
        
        PID:10556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9677.exe
        6⤵
        
        PID:15496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50860.exe
        6⤵
        
        PID:16948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28585.exe
        6⤵
        
        PID:4828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1981.exe
        5⤵
        
        PID:6168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17701.exe
        6⤵
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50321.exe
        7⤵
        
        PID:9020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54270.exe
        7⤵
        
        PID:14528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27690.exe
        7⤵
        
        PID:14644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39775.exe
        6⤵
        
        PID:10904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1866.exe
        6⤵
        
        PID:14624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12095.exe
        6⤵
        
        PID:16368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8638.exe
        5⤵
        
        PID:8624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39517.exe
        6⤵
        
        PID:14056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42777.exe
        6⤵
        
        PID:17384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26720.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42717.exe
        5⤵
        
        PID:15552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36625.exe
      4⤵
      PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7217.exe
        5⤵
        
        PID:6996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65121.exe
        6⤵
        
        PID:9836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43195.exe
        6⤵
        
        PID:13948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49417.exe
        6⤵
        
        PID:17340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53118.exe
        6⤵
        
        PID:17332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10942.exe
        5⤵
        
        PID:9612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44706.exe
        5⤵
        
        PID:13628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36118.exe
        5⤵
        
        PID:16568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39685.exe
        5⤵
        
        PID:16848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65301.exe
      4⤵
      PID:6928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28557.exe
        5⤵
        
        PID:7912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6055.exe
        5⤵
        
        PID:13336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3927.exe
        5⤵
        
        PID:1536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21930.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63828.exe
      4⤵
      PID:14384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48163.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48163.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7674.exe
      4⤵
      PID:3492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10580.exe
        5⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31551.exe
        6⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23077.exe
        7⤵
        
        PID:11212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60274.exe
        7⤵
        
        PID:15952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23075.exe
        7⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-497.exe
        6⤵
        
        PID:10308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58467.exe
        6⤵
        
        PID:14804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19485.exe
        6⤵
        
        PID:17188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15436.exe
        5⤵
        
        PID:8712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26720.exe
        5⤵
        
        PID:13300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52575.exe
        5⤵
        
        PID:17052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-940.exe
        5⤵
        
        PID:5668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6065.exe
      4⤵
      PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22169.exe
        5⤵
        
        PID:7304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46751.exe
        6⤵
        
        PID:11744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38291.exe
        6⤵
        
        PID:14552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33553.exe
        5⤵
        
        PID:10748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1482.exe
        5⤵
        
        PID:15808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48650.exe
        5⤵
        
        PID:17400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26728.exe
      4⤵
      PID:7264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48816.exe
      4⤵
      PID:12252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33238.exe
      4⤵
      PID:16668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30081.exe
      4⤵
      PID:17012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16827.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16827.exe
    3⤵
    PID:3284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27493.exe
      4⤵
      PID:1168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63346.exe
        5⤵
        
        PID:6436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47611.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2075.exe
        5⤵
        
        PID:636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1893.exe
      4⤵
      PID:9396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59069.exe
      4⤵
      PID:14084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52952.exe
      4⤵
      PID:14484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2075.exe
      4⤵
      PID:5060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13254.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13254.exe
    3⤵
    PID:6464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15536.exe
      4⤵
      PID:8848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50788.exe
      4⤵
      PID:12248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24336.exe
      4⤵
      PID:2724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23605.exe
      4⤵
      PID:4216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48402.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48402.exe
    3⤵
    PID:9800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27795.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27795.exe
    3⤵
    PID:13940
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19635.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19635.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15717.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15717.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57155.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18007.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33357.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50845.exe
        7⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18915.exe
        8⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46621.exe
        9⤵
        
        PID:8884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3891.exe
        9⤵
        
        PID:14504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49417.exe
        9⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42080.exe
        9⤵
        
        PID:16492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8281.exe
        8⤵
        
        PID:8880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17626.exe
        8⤵
        
        PID:14696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-819.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26807.exe
        7⤵
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8302.exe
        8⤵
        
        PID:10348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44732.exe
        8⤵
        
        PID:14628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62865.exe
        8⤵
        
        PID:16596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60309.exe
        7⤵
        
        PID:10780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61208.exe
        7⤵
        
        PID:16100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40779.exe
        7⤵
        
        PID:16640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6283.exe
        6⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15755.exe
        7⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63803.exe
        8⤵
        
        PID:15756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33028.exe
        7⤵
        
        PID:12484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16300.exe
        7⤵
        
        PID:17032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10776.exe
        6⤵
        
        PID:8408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56045.exe
        7⤵
        
        PID:15324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2023.exe
        7⤵
        
        PID:17356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17897.exe
        6⤵
        
        PID:11328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45299.exe
        6⤵
        
        PID:16888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37995.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26149.exe
        6⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49833.exe
        7⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44229.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60274.exe
        8⤵
        
        PID:15884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
        8⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-497.exe
        7⤵
        
        PID:10276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58467.exe
        7⤵
        
        PID:14444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18831.exe
        6⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37213.exe
        7⤵
        
        PID:12404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11805.exe
        7⤵
        
        PID:16944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11840.exe
        6⤵
        
        PID:11704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65117.exe
        6⤵
        
        PID:16284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24243.exe
        6⤵
        
        PID:16628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43327.exe
        6⤵
        
        PID:16712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63765.exe
        5⤵
        
        PID:5552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9786.exe
        6⤵
        
        PID:460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50876.exe
        7⤵
        
        PID:8448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55753.exe
        7⤵
        
        PID:14416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45168.exe
        7⤵
        
        PID:16968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3429.exe
        6⤵
        
        PID:9420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53231.exe
        6⤵
        
        PID:13528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12687.exe
        6⤵
        
        PID:16660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26203.exe
        6⤵
        
        PID:7100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55406.exe
        5⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8302.exe
        6⤵
        
        PID:10252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40647.exe
        6⤵
        
        PID:14800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9536.exe
        6⤵
        
        PID:16840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9117.exe
        6⤵
        
        PID:16472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19216.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63828.exe
        5⤵
        
        PID:14128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39363.exe
        5⤵
        
        PID:15144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18561.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10798.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16611.exe
        6⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24115.exe
        7⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15895.exe
        8⤵
        
        PID:8376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14546.exe
        8⤵
        
        PID:15568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34741.exe
        8⤵
        
        PID:15512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41864.exe
        8⤵
        
        PID:16756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34669.exe
        7⤵
        
        PID:9496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51167.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41711.exe
        8⤵
        
        PID:17160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8472.exe
        7⤵
        
        PID:16192
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16192 -s 72
        8⤵
        Program crash
        
        PID:15932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
        7⤵
        
        PID:15796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40211.exe
        6⤵
        
        PID:8592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-356.exe
        6⤵
        
        PID:12340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31406.exe
        6⤵
        
        PID:16980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7630.exe
        6⤵
        
        PID:1568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39531.exe
        5⤵
        
        PID:5768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50565.exe
        6⤵
        
        PID:7672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48951.exe
        7⤵
        
        PID:10420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-383.exe
        7⤵
        
        PID:14792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24528.exe
        7⤵
        
        PID:17320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33028.exe
        6⤵
        
        PID:12492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9615.exe
        6⤵
        
        PID:17044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7630.exe
        6⤵
        
        PID:16692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10776.exe
        5⤵
        
        PID:8384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17897.exe
        5⤵
        
        PID:11536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45299.exe
        5⤵
        
        PID:16928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29172.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16611.exe
        5⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15022.exe
        6⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38645.exe
        7⤵
        
        PID:9672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34233.exe
        7⤵
        
        PID:14976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10624.exe
        7⤵
        
        PID:16544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-497.exe
        6⤵
        
        PID:10284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58467.exe
        6⤵
        
        PID:14728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49558.exe
        5⤵
        
        PID:8092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57005.exe
        6⤵
        
        PID:15548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60954.exe
        6⤵
        
        PID:16136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14773.exe
        5⤵
        
        PID:12948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45247.exe
        5⤵
        
        PID:16580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59132.exe
      4⤵
      PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14450.exe
        5⤵
        
        PID:9560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62796.exe
        5⤵
        
        PID:14008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35601.exe
        5⤵
        
        PID:1568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2075.exe
        5⤵
        
        PID:656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34618.exe
      4⤵
      PID:8512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27251.exe
      4⤵
      PID:13092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41338.exe
      4⤵
      PID:5292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46941.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46941.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13922.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53777.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26149.exe
        6⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13870.exe
        7⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36725.exe
        8⤵
        
        PID:9404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55329.exe
        9⤵
        
        PID:16700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17695.exe
        9⤵
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45334.exe
        8⤵
        
        PID:13996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38509.exe
        8⤵
        
        PID:16212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
        8⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9843.exe
        7⤵
        
        PID:10228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33386.exe
        7⤵
        
        PID:13424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-243.exe
        7⤵
        
        PID:15804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35805.exe
        6⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50347.exe
        7⤵
        
        PID:8780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59340.exe
        7⤵
        
        PID:12432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57969.exe
        7⤵
        
        PID:16112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50221.exe
        6⤵
        
        PID:8072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51120.exe
        6⤵
        
        PID:14280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3062.exe
        6⤵
        
        PID:15376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50030.exe
        5⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54841.exe
        6⤵
        
        PID:7432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48546.exe
        7⤵
        
        PID:7972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8306.exe
        7⤵
        
        PID:14296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2075.exe
        7⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24730.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23492.exe
        6⤵
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7630.exe
        6⤵
        
        PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49863.exe
        5⤵
        
        PID:8280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63445.exe
        6⤵
        
        PID:13500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5645.exe
        5⤵
        
        PID:12652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54332.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35085.exe
        5⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21977.exe
        6⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44613.exe
        7⤵
        
        PID:11496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38291.exe
        7⤵
        
        PID:14920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34669.exe
        6⤵
        
        PID:9608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8472.exe
        6⤵
        
        PID:16324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46739.exe
        5⤵
        
        PID:9256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52298.exe
        5⤵
        
        PID:13712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43153.exe
      4⤵
      PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50565.exe
        5⤵
        
        PID:7568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33295.exe
        6⤵
        
        PID:14616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52786.exe
        6⤵
        
        PID:16912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24363.exe
        5⤵
        
        PID:10592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8472.exe
        5⤵
        
        PID:15868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23605.exe
        5⤵
        
        PID:5756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16641.exe
      4⤵
      PID:8436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9232.exe
      4⤵
      PID:11304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28763.exe
      4⤵
      PID:16896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38162.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38162.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53777.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28863.exe
        5⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50565.exe
        6⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36253.exe
        7⤵
        
        PID:11972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55168.exe
        7⤵
        
        PID:16604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35858.exe
        7⤵
        
        PID:17312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57036.exe
        6⤵
        
        PID:11244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8245.exe
        6⤵
        
        PID:15560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46739.exe
        5⤵
        
        PID:9272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52298.exe
        5⤵
        
        PID:13704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8805.exe
      4⤵
      PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23923.exe
        5⤵
        
        PID:7712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14410.exe
        6⤵
        
        PID:15972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57036.exe
        5⤵
        
        PID:10976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52027.exe
        5⤵
        
        PID:15144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37419.exe
      4⤵
      PID:8496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42402.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45299.exe
      4⤵
      PID:16912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-940.exe
      4⤵
      PID:17104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26372.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26372.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28863.exe
      4⤵
      PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50565.exe
        5⤵
        
        PID:7588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44421.exe
        6⤵
        
        PID:11848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25847.exe
        6⤵
        
        PID:16548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12704.exe
        6⤵
        
        PID:17144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57036.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21300.exe
        5⤵
        
        PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16465.exe
        5⤵
        
        PID:15552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11928.exe
      4⤵
      PID:8632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54244.exe
      4⤵
      PID:13452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31793.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31793.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50565.exe
      4⤵
      PID:7580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe
        5⤵
        
        PID:14584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19345.exe
        5⤵
        
        PID:17348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57036.exe
      4⤵
      PID:10960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45997.exe
      4⤵
      PID:16244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11353.exe
      4⤵
      PID:16232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8506.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8506.exe
    3⤵
    PID:8392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53768.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53768.exe
    3⤵
    PID:11288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25185.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25185.exe
    3⤵
    PID:16820
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63111.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63111.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32075.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32075.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20783.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55147.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19351.exe
        6⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47529.exe
        7⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58001.exe
        8⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-518.exe
        9⤵
        
        PID:10464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55614.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:14984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27690.exe
        9⤵
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-497.exe
        8⤵
        
        PID:10316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58467.exe
        8⤵
        
        PID:14472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33316.exe
        8⤵
        
        PID:16656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41887.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14389.exe
        7⤵
        
        PID:12444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9118.exe
        7⤵
        
        PID:17012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30081.exe
        7⤵
        
        PID:16992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20952.exe
        6⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13735.exe
        7⤵
        
        PID:8268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45255.exe
        7⤵
        
        PID:14272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29444.exe
        6⤵
        
        PID:10212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5506.exe
        6⤵
        
        PID:14332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-725.exe
        6⤵
        
        PID:15792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15821.exe
        5⤵
        
        PID:2100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12718.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54649.exe
        7⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40015.exe
        8⤵
        
        PID:10176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3507.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60196.exe
        7⤵
        
        PID:10764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59427.exe
        7⤵
        
        PID:16068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48650.exe
        7⤵
        
        PID:17272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37996.exe
        7⤵
        
        PID:17268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21545.exe
        6⤵
        
        PID:8644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31302.exe
        6⤵
        
        PID:11628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21362.exe
        5⤵
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20031.exe
        6⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36253.exe
        7⤵
        
        PID:11880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54436.exe
        7⤵
        
        PID:16592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49043.exe
        7⤵
        
        PID:16700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54742.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39766.exe
        6⤵
        
        PID:16804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62277.exe
        6⤵
        
        PID:6836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42900.exe
        5⤵
        
        PID:7224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40151.exe
        5⤵
        
        PID:12212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16703.exe
        5⤵
        
        PID:16716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17790.exe
        5⤵
        
        PID:17280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51618.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65043.exe
        5⤵
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43829.exe
        6⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63367.exe
        7⤵
        
        PID:9288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45334.exe
        7⤵
        
        PID:13412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13620.exe
        7⤵
        
        PID:16936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20930.exe
        7⤵
        
        PID:4044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40185.exe
        6⤵
        
        PID:9624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51696.exe
        6⤵
        
        PID:15168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3504.exe
        6⤵
        
        PID:16312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6159.exe
        6⤵
        
        PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18125.exe
        5⤵
        
        PID:6628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50347.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40865.exe
        6⤵
        
        PID:13268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55491.exe
        6⤵
        
        PID:4536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41350.exe
        6⤵
        
        PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30020.exe
        5⤵
        
        PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41661.exe
        5⤵
        
        PID:15284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42385.exe
      4⤵
      PID:968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4934.exe
        5⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51525.exe
        6⤵
        
        PID:7404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2573.exe
        6⤵
        
        PID:12136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36039.exe
        6⤵
        
        PID:16748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55282.exe
        6⤵
        
        PID:17352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16465.exe
        6⤵
        
        PID:2248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32811.exe
        5⤵
        
        PID:9112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24694.exe
        6⤵
        
        PID:440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39050.exe
        6⤵
        
        PID:16620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23298.exe
        5⤵
        
        PID:12780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26528.exe
        5⤵
        
        PID:16644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20550.exe
        5⤵
        
        PID:15492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2075.exe
        5⤵
        
        PID:5748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27612.exe
      4⤵
      PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16065.exe
        5⤵
        
        PID:8380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55753.exe
        5⤵
        
        PID:14408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26424.exe
      4⤵
      PID:9692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39733.exe
      4⤵
      PID:13884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47147.exe
      4⤵
      PID:16688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21337.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21337.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14114.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65043.exe
        5⤵
        
        PID:5052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27493.exe
        6⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30913.exe
        7⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25628.exe
        7⤵
        
        PID:12532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47586.exe
        6⤵
        
        PID:9428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20969.exe
        6⤵
        
        PID:15184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33012.exe
        5⤵
        
        PID:6564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15895.exe
        6⤵
        
        PID:9040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14546.exe
        6⤵
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8099.exe
        6⤵
        
        PID:16824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26512.exe
        5⤵
        
        PID:8912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14826.exe
        5⤵
        
        PID:14404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41155.exe
        5⤵
        
        PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7054.exe
        5⤵
        
        PID:1356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28649.exe
      4⤵
      PID:1908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27493.exe
        5⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35935.exe
        6⤵
        
        PID:8556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31302.exe
        6⤵
        
        PID:13276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62578.exe
        5⤵
        
        PID:8460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26663.exe
        6⤵
        
        PID:16120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
        6⤵
        
        PID:6824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12032.exe
        5⤵
        
        PID:11292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53964.exe
        5⤵
        
        PID:16844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15524.exe
      4⤵
      PID:6456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42973.exe
        5⤵
        
        PID:7924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36253.exe
        6⤵
        
        PID:11996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55168.exe
        6⤵
        
        PID:16620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62481.exe
        6⤵
        
        PID:16200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2189.exe
        5⤵
        
        PID:11648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52027.exe
        5⤵
        
        PID:15492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2075.exe
        5⤵
        
        PID:12244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43860.exe
      4⤵
      PID:8664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63093.exe
      4⤵
      PID:12348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6205.exe
      4⤵
      PID:16960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27254.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27254.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23025.exe
      4⤵
      PID:5268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15755.exe
        5⤵
        
        PID:7644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15012.exe
        6⤵
        
        PID:15348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19537.exe
        6⤵
        
        PID:16736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57036.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21300.exe
        5⤵
        
        PID:7236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46739.exe
      4⤵
      PID:9280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25656.exe
      4⤵
      PID:13104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2226.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2226.exe
    3⤵
    PID:5920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1125.exe
      4⤵
      PID:8756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7088.exe
        5⤵
        
        PID:11376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38291.exe
        5⤵
        
        PID:14464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53128.exe
        5⤵
        
        PID:16888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61809.exe
      4⤵
      PID:12368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31406.exe
      4⤵
      PID:16972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18083.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18083.exe
    3⤵
    PID:8504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21235.exe
      4⤵
      PID:15308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52620.exe
      4⤵
      PID:15752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42785.exe
      4⤵
      PID:17172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
      4⤵
      PID:5724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5720.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5720.exe
    3⤵
    PID:13116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13867.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13867.exe
    3⤵
    PID:15556
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54368.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54368.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26813.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26813.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20145.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7051.exe
        5⤵
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7202.exe
        6⤵
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8302.exe
        7⤵
        
        PID:10332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44732.exe
        7⤵
        
        PID:14788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41249.exe
        7⤵
        
        PID:17364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23605.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64472.exe
        6⤵
        
        PID:10532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3812.exe
        6⤵
        
        PID:15292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59445.exe
        6⤵
        
        PID:16752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37035.exe
        5⤵
        
        PID:7172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10710.exe
        6⤵
        
        PID:14480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31741.exe
        6⤵
        
        PID:6876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48816.exe
        5⤵
        
        PID:12176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33238.exe
        5⤵
        
        PID:16692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30081.exe
        5⤵
        
        PID:17232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63268.exe
      4⤵
      PID:5316
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5316 -s 632
        5⤵
        Program crash
        
        PID:7164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22542.exe
      4⤵
      PID:6184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32706.exe
        5⤵
        
        PID:9824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1588.exe
        5⤵
        
        PID:15936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16465.exe
        5⤵
        
        PID:17144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20778.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15613.exe
      4⤵
      PID:13428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21467.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21467.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7051.exe
      4⤵
      PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58001.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49937.exe
        6⤵
        
        PID:9524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37549.exe
        6⤵
        
        PID:13100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60465.exe
        5⤵
        
        PID:10712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57892.exe
        5⤵
        
        PID:15384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40735.exe
      4⤵
      PID:8056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17919.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42777.exe
        5⤵
        
        PID:3348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6108.exe
      4⤵
      PID:12964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47019.exe
      4⤵
      PID:15780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13192.exe
      4⤵
      PID:1284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11466.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11466.exe
    3⤵
    PID:5252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
      4⤵
      PID:6208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43165.exe
        5⤵
        
        PID:8172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8598.exe
        6⤵
        
        PID:14556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25567.exe
        6⤵
        
        PID:17024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25628.exe
        5⤵
        
        PID:12168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13081.exe
        5⤵
        
        PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27690.exe
        5⤵
        
        PID:1228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34757.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34757.exe
      4⤵
      PID:8608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47611.exe
      4⤵
      PID:11552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2844.exe
      4⤵
      PID:15736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21389.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21389.exe
    3⤵
    PID:6448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51525.exe
      4⤵
      PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53803.exe
        5⤵
        
        PID:11248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60274.exe
        5⤵
        
        PID:15908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25014.exe
        5⤵
        
        PID:17128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59366.exe
      4⤵
      PID:11932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3366.exe
      4⤵
      PID:16632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26203.exe
      4⤵
      PID:17160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43747.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43747.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:9120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3963.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3963.exe
    3⤵
    PID:12792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33592.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33592.exe
    3⤵
    PID:16108
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17882.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17882.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24229.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24229.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15843.exe
      4⤵
      PID:3756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31577.exe
        5⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58733.exe
        6⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53803.exe
        7⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60274.exe
        7⤵
        
        PID:16504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49417.exe
        7⤵
        
        PID:17388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1047.exe
        7⤵
        
        PID:1784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57036.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21300.exe
        6⤵
        
        PID:17172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15219.exe
        6⤵
        
        PID:15536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46739.exe
        5⤵
        
        PID:9240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25656.exe
        5⤵
        
        PID:12400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18125.exe
      4⤵
      PID:6620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48977.exe
        5⤵
        
        PID:9472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14607.exe
        5⤵
        
        PID:13920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37996.exe
        5⤵
        
        PID:4592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23578.exe
      4⤵
      PID:10196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14171.exe
      4⤵
      PID:14312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32285.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:17360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22427.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22427.exe
    3⤵
    PID:4016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52573.exe
      4⤵
      PID:6228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24857.exe
        5⤵
        
        PID:8936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60108.exe
        5⤵
        
        PID:12428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
      4⤵
      PID:9708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20969.exe
      4⤵
      PID:15176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43685.exe
      4⤵
      PID:14892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50335.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50335.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32807.exe
      4⤵
      PID:1392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47185.exe
      4⤵
      PID:16960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12531.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12531.exe
    3⤵
    PID:9792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54131.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54131.exe
    3⤵
    PID:13928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25336.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25336.exe
    3⤵
    PID:16740
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56132.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56132.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7051.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7051.exe
    3⤵
    PID:5764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51971.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1634.exe
        5⤵
        
        PID:11588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38291.exe
        5⤵
        
        PID:14484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-497.exe
      4⤵
      PID:10300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54383.exe
      4⤵
      PID:14760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1858.exe
      4⤵
      PID:17376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11519.exe
      4⤵
      PID:15848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42873.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42873.exe
    3⤵
    PID:7964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59719.exe
      4⤵
      PID:16388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57664.exe
      4⤵
      PID:15052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41350.exe
      4⤵
      PID:4164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21789.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21789.exe
    3⤵
    PID:11728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49227.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49227.exe
    3⤵
    PID:15452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49067.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49067.exe
    3⤵
    PID:15896
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9196.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9196.exe
  2⤵
  PID:5244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40129.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40129.exe
    3⤵
    PID:6368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1914.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1914.exe
      4⤵
      PID:9132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22391.exe
      4⤵
      PID:13392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46216.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46216.exe
    3⤵
    PID:9744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21235.exe
      4⤵
      PID:15240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9615.exe
      4⤵
      PID:16904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4658.exe
      4⤵
      PID:16264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56931.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56931.exe
    3⤵
    PID:14252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9381.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9381.exe
    3⤵
    PID:16368
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60550.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60550.exe
  2⤵
  PID:5432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44483.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44483.exe
    3⤵
    PID:7560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39199.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39199.exe
    3⤵
    PID:15772
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 15772 -s 464
      4⤵
      Program crash
      PID:16896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
    3⤵
    PID:4536
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31775.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31775.exe
  2⤵
  PID:8932
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58228.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58228.exe
  2⤵
  PID:14712
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27856.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27856.exe
  2⤵
  PID:17044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5316 -ip 5316
1⤵
PID:6376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5148 -ip 5148
1⤵
PID:7828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5040 -ip 5040
1⤵
PID:9824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 17104 -ip 17104
1⤵
PID:972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 15772 -ip 15772
1⤵
PID:16260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1348.exe

Filesize
468KB

MD5
4034a203aab33250e3bace327f772da5

SHA1
f8988e2e788c722d17f95ecf2ab8b4a3fd09fb84

SHA256
fb1f1a8edcb68bda775bb1e1ab2c2e578869003c829f58d7bb307a5b336ca014

SHA512
9524407da052a9dffcf1c853313affeb542196a426ba1c63342c6302321be21b6dff8d884c93bd317d8d9cd7fc92ce582abc008178f8d845923ebbf50bc36c35

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13922.exe

Filesize
468KB

MD5
db8ecae6b192e6dcede00e1c8cdcc738

SHA1
067b9cc3d8954e3c36d734d0aa0ec510a9bf33fa

SHA256
0e50c853692655ae36fe3d17a9cc0c40161d6303e16e86c6fbc6b79ffc5e5d45

SHA512
bae06fab477cfaad0f429f76be2317232f348f179ce9c1a0088b8fdd75c733179009d73092e566abc9e97032beb95e7406f5bee29730c7e95a4a91535ec81047

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15717.exe

Filesize
468KB

MD5
4f0dbc856c55b2d95884cca2218fc54a

SHA1
567b560ce18be89d9c95e3e3008b7ecdc171e201

SHA256
06f87ddab151bfdb84a72e777f5ceade9415bb903e4bf2529c60016b25894a2e

SHA512
593a8cbc3beb858e3b9e63d436248d70fd8662902ad67dc23cd977ee8b9a665cd86dd4ab4aae46db494a30eb38791e8324fb6c88877e2593f0822c2fadcd7962

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16598.exe

Filesize
468KB

MD5
f30db6730caf867f171c331a44d79a63

SHA1
7c2415cae65b3fcbac51c41a130493468127f021

SHA256
fa53ec751fb969f94ae956d299267fd4515fc9eb17185b5d11a1f7d4bd595fc5

SHA512
faf81b857624d5cc123be835826b7b1da92610a465ddf256a839f25f170cfdc689eb071a1ef195783ad2e10eb88e10383100381560d439bb6db2cbf89fb39075

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17318.exe

Filesize
468KB

MD5
104d7f34babb4bf84c5f23546a00196e

SHA1
600c23ad6f3775663b74265ce568179a4587c9fd

SHA256
ca4b42bb31f7303cac30bd14be584dba60703d374a29f3d347a19b91054cd19c

SHA512
6da50bcd58f39607afeb615fdda21c3867ab8a6ef2468a2f84442ca799db40ddeae9c3f460358d22658038293b8fc9b45f0ebabb75a012961c5a891f83f5f1fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17882.exe

Filesize
468KB

MD5
0602dcc6a8fddf0b40083b499a52577c

SHA1
141fcc7f58746eb50ae54d26903d7e8708547385

SHA256
3269ade54f938fb2f456b96deaa37fc20ca3903b60aed6a9df9ceee87090a702

SHA512
6e41686bcda5b5480baa6728549b9a29c0c7c4168c1f11ee12c1c40aeeb2ace2a2746a4f0b4e2ea61bfcb3a6d86c8d36e37397926580a1d31b162bbc2f4f2ca1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18007.exe

Filesize
468KB

MD5
557dc37df23524e376af3d78ba46dc2b

SHA1
a1626130cdb85b33a1f6c16ef174c35624d173b4

SHA256
fdf8f1e5f7921c6ac94512bcb98faee59204a2ae71d3200d0ae537ba9bcdec60

SHA512
44bc7e6e8315a8e5a7d50027ebdf767751c493dae8bcf2e18a10de5a983b35a5750f8cbe11762f14bdd62416fc1a6f24b4c2746908309eab29b85fe7c619f516

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18561.exe

Filesize
468KB

MD5
4deb1307609a3e5dd76c44f3cd3df478

SHA1
b4a99e042e1743b855c10da2a1e8d2e7fa2da755

SHA256
83a1be76de1eea3015739c803f920fb1e1044431159b9d1045b88b225fea2708

SHA512
a75e5557263c1ac82dc7641c75f07f298ec4226efafd502480c4af86e361c3b5380be9943bd4fc6cb2a40bc92bfd08578611d0b1b68d2a9e1827fb15a77fef86

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19635.exe

Filesize
468KB

MD5
ac4b49830ad54ca42fe831892039e883

SHA1
a348bb75c411a5e55bc3286488f52e2f5f8630ce

SHA256
c303364b9f3b0ed7137750f19a6ec2003a0c0cefd6b99f6c4eb87f7ea5c55875

SHA512
d57c42f419a57d0cdd2b97237fe3061c45d7ea3dc215ed7ff031cc3f87a9b39183346eb82e25d41556a1183736f1b0b2a2936e5ffc1521a4f3104748b54b4af3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19749.exe

Filesize
468KB

MD5
6478329fefc65cddb090c728e1854245

SHA1
3beed7c03482baa76f2d45d28eb44e19176656c1

SHA256
947a6e11c2fc9454118b66734ae8a436d10c5706e83b1a0e5fb310d141344a50

SHA512
e64854c979e7f5d1f35d5ec34988354a20a8fadf6c25d44bb7dbd2fa08af934770baca92dbac03c176b2473b367b7f5f5e85c7054a830353a4350eb004606152

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20783.exe

Filesize
468KB

MD5
85c9c336ef9c2e5e4156ceaea7268554

SHA1
13e801820bfdd5816d9bf7b3e566429044cee3cc

SHA256
06eb916321f1690b616e5e7ac1a627dac3086c0cf3ad7ce0f29ce3d77b7ef31f

SHA512
ff276d615b6c6edfc03d94faf1b54fd6bbe24b32eb16c1592199104060a056d43a99d877f630c4b3268b19ca4dc2b37e3e786c493d6af5c94932a6ea7af12323

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21337.exe

Filesize
468KB

MD5
45e3f71b8f5a82d169ddcadc7c663c19

SHA1
8b3927b27c447cfc5d78a7caabc1630912a0e866

SHA256
f6d6992473f97fb7e5e4559e5151d5c6aa1f97154b781c14f9114ba5c2c136c3

SHA512
6e202a5cdde16f6fbdfa53e4c63f6151df71308b82828fbdcf0a56db938e2020ab7e5581313bbfca2e48084d3754db96ccf497f29c26ae8923f1194727befc69

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22453.exe

Filesize
468KB

MD5
87288be247736035cecc9d5f03f344db

SHA1
3049db1249782e8ef3487de1a9408b1bcbe48cd8

SHA256
1b32b38f763d488c28e8ceaaa8ee5ccc724ae513d4487fed6e0b89e66a6874ea

SHA512
4b239b23012aa36566493f0941714f8f3026840a5b1dfd3b09b7e43950ae9897d862750b6ba16c38c42febd7a9148d203f3abc1d9148a670f4b32e2eb2a3e12b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26097.exe

Filesize
468KB

MD5
a39156d54f86a849d1fb3b320b113231

SHA1
d15af1f5c987fe415fad39dee428a31359c4bf9a

SHA256
8302adff4355db8ea84a333a0a9ce9104e4fe4002553a4ef7ff3fd8b30d17b56

SHA512
d0d9376c83e81155af6f8311c7d84c09da22759b60b258254aa40d5256f7a776fad7bd6ecc7d33e740193700e348c733290c395aac9406e3772c91c81385bc3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26548.exe

Filesize
468KB

MD5
1e8fd0e970672858b0a8db4f683a2dbb

SHA1
ab50afdf3d3d0d02df3a0cd14dd3bd3cc9667331

SHA256
b9d9bc35c198599998a89c33c313935b077682455b7aac66437f76936abc6e4f

SHA512
4400d8486cb1baa6cb4d5ec0bf192a49a048c6cd6c522cbac67d16c8f0e854e5e3036866b4f205a342f97209dfb1d984744faa47c0491e37606771e605b1ba71

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26813.exe

Filesize
468KB

MD5
90a5d780348774014daf0c1061c39417

SHA1
fcbbf62fc8a9ab05bff84faf4bf00b7f7c667249

SHA256
0bf2f5abb1a0c83eac3b7b4cf47329c7b016626c63b3f0177cf3a91e037bd039

SHA512
0c0e096b61ea1342c4fce74e7d176e54351a544e661e0f78cfc01b230e2301703ca77b19eac7312cfe50b57efecb7216b34604300ea5503fd25cc3c54b92b5aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28697.exe

Filesize
468KB

MD5
cf3f9cc2aa2cc773c71c41f10c2c967e

SHA1
1758d84e885fedae78664762abbe678b2ca5d322

SHA256
0ed1b52e13516154d5076af10f3cee81d184ffd6210d01e3e0ec93185fff6076

SHA512
85cdae5d646c276e26e72dad0785935da24f15e0126a2e4a511dce5760999810212c8d1b9752f6ca06914bc04b4e94fd04763e291ad39724a8648090ff9e7467

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28951.exe

Filesize
468KB

MD5
5f089cb2d6555d12e9129f8a9d694f97

SHA1
e144ec794273f1e2fcbb214a1b4b4a897f808b96

SHA256
de7414faca14db7cca345dce2d277db0c9a05e7e5412b80ce009900e9eeca650

SHA512
75cdc6567602bb85bf0722d2f99b203ba4b241e9aca86b10dfec4e5d6e0089397ae7014adc8ad2c778b4038bc1a64bd0fc0b8f82f0859ed5cf695aa7d87a31e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32075.exe

Filesize
468KB

MD5
955136902e115a1067dcc6c55676a435

SHA1
6cd2bef75e06061943cf4665336701e8fc8c1a1c

SHA256
be3915d739848a591d60e8d61548247c51f7675cea5c252305cb1a215e800c4a

SHA512
f24b83f80c30dfc0b113b8f9b2bc91a7ae90f857396c61fe0236e3180da87ea4d4cfb58790d89d37e479d4bcc07f1aecce75c9d2e8c04b5eb8190413fd93ab9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34767.exe

Filesize
468KB

MD5
0b8ca2d9d30f683a012b771325869351

SHA1
95749f1531e0f2e06ca2d8ab445dfd9b16f753d1

SHA256
cb96081066eecdc48a7f4692379dffb1ff961b042dfcffabb06e3068bc2d7e20

SHA512
8c8e2f30257f43b1bc398ada4a2503a0adfff99e417600e24bcc5c563a632c54e20aabf3ada46dbfb4b61b0908db2a3babb7f41321d20d67537611dbb527e2d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35727.exe

Filesize
468KB

MD5
d86764a45804292bb73caf38fc4b1bc4

SHA1
9bde115ab02ac70b10a339009bc9f9c52eaeca97

SHA256
462b7c935f72853991dda51b67f28a5c001cebc7639636ac8ca3a1c209f02422

SHA512
9de5dda46849326e1021bc5f893afbf0012fbc4356b8465fa2d242ae3025b3797794435f136920f9247d59606a9e53b36fcc255036dc231031a0a700e52b025c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38162.exe

Filesize
468KB

MD5
34a01265d0f83a5552b3e392bbf78b70

SHA1
d1f4fae6f9f82afed677c1b07bff44c64533aea6

SHA256
abf675b87a8fca17581b15e2ef6d592d1850f595fb8c8cb6c37083ecc329d81b

SHA512
f1457d89ee9c84d95cbdb655560ae54ef0122e0fb50629139418eaefd61e640dc832a92e2a9df4e545c4c5aa8edf149a12b7f659cc201c56b99d81038a6c7313

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43585.exe

Filesize
468KB

MD5
8bbbe209df33abf3677d0b55bbd7a2ae

SHA1
5cde029d9cc2fcf76d7b2bed3ccfd7f1d17e8d22

SHA256
5d3bfdf0460294551c09d000740748b4ee970246451529107a7eaea0dfa3186c

SHA512
f2780441c4cc6287fffd7ff46017b06549258523fbeddce7de1173d415eaaca8bf63e853ce4bf0bffc7bead22b775e6c86f1024c879254d581c353ef0bdc1e35

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46941.exe

Filesize
468KB

MD5
78c926ce2d048f79579c95dcc5581aab

SHA1
5eae6102965ac0e862493af592f1034dc4485f50

SHA256
45536200a996448bbe1b643609a7c170cdee202af1ff9e899c6df0e6407020f8

SHA512
0b3e8214dca17641ce85194a0c3373c6068c65d3b639f83fcf9b62daf0643e62589df96f812b98b2cb41d6edb30c89aff57be8a9b5c72723365168b2eba5ea9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48503.exe

Filesize
468KB

MD5
e450d377d7e2eaab71f9182f639a3ed0

SHA1
d3f4f8303e1919479f0e03e648d8cf444fa986a4

SHA256
7bb1ec04bbd35538383ee9c35903561e51752428eac1d5f014fcabba77e53eed

SHA512
fe5237d92547b3910f47ac5a5c0f678954a31dba48d2e15396326c24364e692e9ef76522f004eaabafdef3903dea22019769c90a33e5c52e844ed8563702417b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49376.exe

Filesize
468KB

MD5
e9642f577b20e07f94548033879b7fbb

SHA1
a3ba9a10f83819c66b48a00ef7f8bfd67b88d65c

SHA256
3bbdbfa120f63eca159229c5c60592e372b6c074470a7c5955f01c72693ed656

SHA512
cda73c9eeafc63213634a5f0f864c351fee80d3ef552391335087e9cca244013fbcedfafe975f49485809c1a1f5c4321828521e24a06c3d2c164a4f1cf86b327

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54368.exe

Filesize
468KB

MD5
e98607614239ab5b9a025900089a99d4

SHA1
4ac9a49af558477d4556301cf6b28fb0c57025a5

SHA256
a0dc64f7aef867119b5beefd384ec087eeddececaf681c413051703ae145d146

SHA512
1e16080a8668de494a7bfd211ba08dc005e5b556bbdf19d43b0aeffa7c9aaa9e08d4411d7fab741ace48ae0518394360b5c5695d5a670075e13a479f47c041a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55593.exe

Filesize
468KB

MD5
de52966a253bb992fb8f1d5f14500758

SHA1
92fb4f1b47e7d9ae39d5a93b12e1cb0f85a6a717

SHA256
c9f392c7a4727de470012e92d68f68aa30fb0a8d63710eb5fe97e52018627cf9

SHA512
b82e3d746597f83355df5573594db96383ec99f87d1b16a0b08d299c084efb51dd4d6b1784b5730e72527e4a9f79fda11be6526bf5488c17e8b844477f48eb63

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57155.exe

Filesize
468KB

MD5
f1f632ef3c17e4b15a4290240fee1b34

SHA1
cdf31bb15c3b2296fd0544a2f26836a61f22c81f

SHA256
da0cae0c1463130fc49de51553ccac6b74ccb30e626b4ab7950d90951f009e30

SHA512
b1eb42c67c5522415b51b02b6aa439f7273556f93f2da8d0bce987323372608a0ddf2267ac50fa7d5ce8d1a9e79880c2c1cdb0328fd7a1e9c82ab61401a9940a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60232.exe

Filesize
468KB

MD5
bccf14229eca2a98dec68923360602b6

SHA1
613f80987b2353fb104c1c889f3f6c3c1f0f97cf

SHA256
748e08aa64d1efa99508e5ebfd6e5e02f72045c2bb532baa27c7cd792897d59e

SHA512
c1f895b82f45ca0f9434c735e9b9e1298c7c91f6f3531bc8652d42626535e05d2565d990defeeee4ae0e54495763ba9f83b00ec1b94aed830131322230e5ecc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63111.exe

Filesize
468KB

MD5
650b4fad70a0e4164b95d39e788da461

SHA1
3bb9ca2f41fa62220a1c0123e2bbace2ff0cb3ed

SHA256
db5530da443048e34d7f6331597cee529ff6e68993849d27358af15dea23fb8d

SHA512
b6400ccbafe39f59471de23f4a6e776ad1864dea7721d70ce1f6ab3926e1be4433992a0a00de971c5e615b787f3664a84e98bec28f01893a01e8f272763f3e3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7788.exe

Filesize
468KB

MD5
0d195be90c9717bff20bf0a61f7a4427

SHA1
4a0c9802075e883d57b5fe01ff46799ec63508a8

SHA256
8633382a1bbd94e4f0315b6760f7b47503f776231297d317cf6779e2d8cc8ca0

SHA512
622588fcfda8fb4546383566e0cc7f8fb4a8ed58cd009f3b65b6c844fbfec89ea662e562269ad636f8238c7e122bd90480e2af5913d38a3114f9f291b4627e09

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads