8776d304de97d986090cb73619f28bfd83c052c61f23d9865ee43f5efefd8427

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 07:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5afa6f78a019ca1dcead02bc49841ec0N.exe
Size

184KB
MD5

5afa6f78a019ca1dcead02bc49841ec0
SHA1

06efcdd608764a20ae5ba2f3fe8e7c6d46c602b2
SHA256

8776d304de97d986090cb73619f28bfd83c052c61f23d9865ee43f5efefd8427
SHA512

e1ee0f81ac607835b7a333dbf63d2d617c0358bcd56045b5687712783dca7774ac9c0b38d1563c5e59e7d694b24bb2fcfc97bf20715f4275db3b789002b13098
SSDEEP

3072:FblIw3o8nCoUdDZFKXabK+ElvMqnSibe:FbVoIQDZVbK+ElEqnSib

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
444	Unicorn-34267.exe
1516	Unicorn-59547.exe
1036	Unicorn-56018.exe
4192	Unicorn-52251.exe
4868	Unicorn-3050.exe
4584	Unicorn-48722.exe
2828	Unicorn-13448.exe
3728	Unicorn-22179.exe
2600	Unicorn-27009.exe
448	Unicorn-55043.exe
4364	Unicorn-6034.exe
1616	Unicorn-2505.exe
4456	Unicorn-37098.exe
2296	Unicorn-31232.exe
2236	Unicorn-44026.exe
3784	Unicorn-54571.exe
368	Unicorn-2033.exe
4324	Unicorn-7482.exe
3412	Unicorn-26048.exe
1108	Unicorn-40347.exe
2736	Unicorn-45178.exe
224	Unicorn-7674.exe
3852	Unicorn-40539.exe
2316	Unicorn-20673.exe
3020	Unicorn-56875.exe
3920	Unicorn-56305.exe
3532	Unicorn-65235.exe
4732	Unicorn-15769.exe
3396	Unicorn-18072.exe
4204	Unicorn-9786.exe
4992	Unicorn-11824.exe
1228	Unicorn-32475.exe
4404	Unicorn-28945.exe
2012	Unicorn-65339.exe
1416	Unicorn-1840.exe
2732	Unicorn-42179.exe
1796	Unicorn-55178.exe
2060	Unicorn-50923.exe
1508	Unicorn-17985.exe
3440	Unicorn-49579.exe
3556	Unicorn-29713.exe
768	Unicorn-10776.exe
4804	Unicorn-33435.exe
2196	Unicorn-57369.exe
4388	Unicorn-17099.exe
4836	Unicorn-33627.exe
4928	Unicorn-38457.exe
1944	Unicorn-46626.exe
1480	Unicorn-9122.exe
3848	Unicorn-25651.exe
1084	Unicorn-24689.exe
1488	Unicorn-30289.exe
812	Unicorn-9314.exe
4580	Unicorn-17483.exe
1388	Unicorn-51618.exe
1104	Unicorn-45753.exe
2380	Unicorn-57098.exe
3764	Unicorn-51499.exe
1852	Unicorn-2490.exe
60	Unicorn-56330.exe
544	Unicorn-18561.exe
2648	Unicorn-21131.exe
4660	Unicorn-34129.exe
2132	Unicorn-4986.exe

Program crash 9 IoCs

pid	pid_target	Process	procid_target
732	3532	WerFault.exe	119
6528	4660	WerFault.exe	158
5172	4660	WerFault.exe	158
6200	4660	WerFault.exe	158
8164	7180	WerFault.exe	309
8712	6612	WerFault.exe	245
14108	6700	WerFault.exe	281
16996	15272	WerFault.exe	752
8644	5156	Process not Found	984

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38726.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8838.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55635.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45558.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37286.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16510.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43184.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24744.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19983.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49579.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47479.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48455.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36319.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5afa6f78a019ca1dcead02bc49841ec0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3614.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37927.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34883.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38678.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51591.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45454.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2314.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13246.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6127.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29040.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55043.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33435.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7424.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62606.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48488.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32958.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45217.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48161.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37736.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55422.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9405.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60910.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32475.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25046.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44943.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30054.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12205.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61039.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51215.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31822.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4910.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57224.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53031.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28696.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61520.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17985.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56256.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48680.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59096.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16736.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32830.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25174.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45454.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	18016	dwm.exe
Token: SeChangeNotifyPrivilege	18016	dwm.exe
Token: 33	18016	dwm.exe
Token: SeIncBasePriorityPrivilege	18016	dwm.exe
Token: SeCreateGlobalPrivilege	19324	Process not Found
Token: SeChangeNotifyPrivilege	19324	Process not Found
Token: 33	19324	Process not Found
Token: SeIncBasePriorityPrivilege	19324	Process not Found

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3612	5afa6f78a019ca1dcead02bc49841ec0N.exe
444	Unicorn-34267.exe
1516	Unicorn-59547.exe
1036	Unicorn-56018.exe
4192	Unicorn-52251.exe
4868	Unicorn-3050.exe
4584	Unicorn-48722.exe
2828	Unicorn-13448.exe
3728	Unicorn-22179.exe
2600	Unicorn-27009.exe
448	Unicorn-55043.exe
4364	Unicorn-6034.exe
1616	Unicorn-2505.exe
2296	Unicorn-31232.exe
4456	Unicorn-37098.exe
2236	Unicorn-44026.exe
3784	Unicorn-54571.exe
368	Unicorn-2033.exe
4324	Unicorn-7482.exe
3412	Unicorn-26048.exe
1108	Unicorn-40347.exe
2736	Unicorn-45178.exe
224	Unicorn-7674.exe
3852	Unicorn-40539.exe
4732	Unicorn-15769.exe
3020	Unicorn-56875.exe
3920	Unicorn-56305.exe
2316	Unicorn-20673.exe
3396	Unicorn-18072.exe
3532	Unicorn-65235.exe
4204	Unicorn-9786.exe
4992	Unicorn-11824.exe
1228	Unicorn-32475.exe
4404	Unicorn-28945.exe
2012	Unicorn-65339.exe
1416	Unicorn-1840.exe
2732	Unicorn-42179.exe
1796	Unicorn-55178.exe
2060	Unicorn-50923.exe
1508	Unicorn-17985.exe
3440	Unicorn-49579.exe
3556	Unicorn-29713.exe
768	Unicorn-10776.exe
4804	Unicorn-33435.exe
2196	Unicorn-57369.exe
4388	Unicorn-17099.exe
4836	Unicorn-33627.exe
4928	Unicorn-38457.exe
1480	Unicorn-9122.exe
1488	Unicorn-30289.exe
1084	Unicorn-24689.exe
1944	Unicorn-46626.exe
3848	Unicorn-25651.exe
4580	Unicorn-17483.exe
1388	Unicorn-51618.exe
1104	Unicorn-45753.exe
812	Unicorn-9314.exe
2380	Unicorn-57098.exe
3764	Unicorn-51499.exe
1852	Unicorn-2490.exe
60	Unicorn-56330.exe
544	Unicorn-18561.exe
2648	Unicorn-21131.exe
2132	Unicorn-4986.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 444	3612	5afa6f78a019ca1dcead02bc49841ec0N.exe	90
PID 3612 wrote to memory of 444	3612	5afa6f78a019ca1dcead02bc49841ec0N.exe	90
PID 3612 wrote to memory of 444	3612	5afa6f78a019ca1dcead02bc49841ec0N.exe	90
PID 444 wrote to memory of 1516	444	Unicorn-34267.exe	92
PID 444 wrote to memory of 1516	444	Unicorn-34267.exe	92
PID 444 wrote to memory of 1516	444	Unicorn-34267.exe	92
PID 3612 wrote to memory of 1036	3612	5afa6f78a019ca1dcead02bc49841ec0N.exe	93
PID 3612 wrote to memory of 1036	3612	5afa6f78a019ca1dcead02bc49841ec0N.exe	93
PID 3612 wrote to memory of 1036	3612	5afa6f78a019ca1dcead02bc49841ec0N.exe	93
PID 1516 wrote to memory of 4192	1516	Unicorn-59547.exe	96
PID 1516 wrote to memory of 4192	1516	Unicorn-59547.exe	96
PID 1516 wrote to memory of 4192	1516	Unicorn-59547.exe	96
PID 1036 wrote to memory of 4868	1036	Unicorn-56018.exe	97
PID 1036 wrote to memory of 4868	1036	Unicorn-56018.exe	97
PID 1036 wrote to memory of 4868	1036	Unicorn-56018.exe	97
PID 444 wrote to memory of 4584	444	Unicorn-34267.exe	98
PID 444 wrote to memory of 4584	444	Unicorn-34267.exe	98
PID 444 wrote to memory of 4584	444	Unicorn-34267.exe	98
PID 3612 wrote to memory of 2828	3612	5afa6f78a019ca1dcead02bc49841ec0N.exe	99
PID 3612 wrote to memory of 2828	3612	5afa6f78a019ca1dcead02bc49841ec0N.exe	99
PID 3612 wrote to memory of 2828	3612	5afa6f78a019ca1dcead02bc49841ec0N.exe	99
PID 4192 wrote to memory of 3728	4192	Unicorn-52251.exe	100
PID 4192 wrote to memory of 3728	4192	Unicorn-52251.exe	100
PID 4192 wrote to memory of 3728	4192	Unicorn-52251.exe	100
PID 1516 wrote to memory of 2600	1516	Unicorn-59547.exe	101
PID 1516 wrote to memory of 2600	1516	Unicorn-59547.exe	101
PID 1516 wrote to memory of 2600	1516	Unicorn-59547.exe	101
PID 4868 wrote to memory of 448	4868	Unicorn-3050.exe	102
PID 4868 wrote to memory of 448	4868	Unicorn-3050.exe	102
PID 4868 wrote to memory of 448	4868	Unicorn-3050.exe	102
PID 4584 wrote to memory of 4364	4584	Unicorn-48722.exe	103
PID 4584 wrote to memory of 4364	4584	Unicorn-48722.exe	103
PID 4584 wrote to memory of 4364	4584	Unicorn-48722.exe	103
PID 1036 wrote to memory of 1616	1036	Unicorn-56018.exe	104
PID 1036 wrote to memory of 1616	1036	Unicorn-56018.exe	104
PID 1036 wrote to memory of 1616	1036	Unicorn-56018.exe	104
PID 3612 wrote to memory of 4456	3612	5afa6f78a019ca1dcead02bc49841ec0N.exe	105
PID 3612 wrote to memory of 4456	3612	5afa6f78a019ca1dcead02bc49841ec0N.exe	105
PID 3612 wrote to memory of 4456	3612	5afa6f78a019ca1dcead02bc49841ec0N.exe	105
PID 444 wrote to memory of 2296	444	Unicorn-34267.exe	106
PID 444 wrote to memory of 2296	444	Unicorn-34267.exe	106
PID 444 wrote to memory of 2296	444	Unicorn-34267.exe	106
PID 2828 wrote to memory of 2236	2828	Unicorn-13448.exe	107
PID 2828 wrote to memory of 2236	2828	Unicorn-13448.exe	107
PID 2828 wrote to memory of 2236	2828	Unicorn-13448.exe	107
PID 3728 wrote to memory of 3784	3728	Unicorn-22179.exe	108
PID 3728 wrote to memory of 3784	3728	Unicorn-22179.exe	108
PID 3728 wrote to memory of 3784	3728	Unicorn-22179.exe	108
PID 4192 wrote to memory of 368	4192	Unicorn-52251.exe	109
PID 4192 wrote to memory of 368	4192	Unicorn-52251.exe	109
PID 4192 wrote to memory of 368	4192	Unicorn-52251.exe	109
PID 2600 wrote to memory of 4324	2600	Unicorn-27009.exe	110
PID 2600 wrote to memory of 4324	2600	Unicorn-27009.exe	110
PID 2600 wrote to memory of 4324	2600	Unicorn-27009.exe	110
PID 1516 wrote to memory of 3412	1516	Unicorn-59547.exe	111
PID 1516 wrote to memory of 3412	1516	Unicorn-59547.exe	111
PID 1516 wrote to memory of 3412	1516	Unicorn-59547.exe	111
PID 4364 wrote to memory of 1108	4364	Unicorn-6034.exe	112
PID 4364 wrote to memory of 1108	4364	Unicorn-6034.exe	112
PID 4364 wrote to memory of 1108	4364	Unicorn-6034.exe	112
PID 4584 wrote to memory of 2736	4584	Unicorn-48722.exe	113
PID 4584 wrote to memory of 2736	4584	Unicorn-48722.exe	113
PID 4584 wrote to memory of 2736	4584	Unicorn-48722.exe	113
PID 448 wrote to memory of 224	448	Unicorn-55043.exe	114

C:\Users\Admin\AppData\Local\Temp\5afa6f78a019ca1dcead02bc49841ec0N.exe
"C:\Users\Admin\AppData\Local\Temp\5afa6f78a019ca1dcead02bc49841ec0N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34267.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34267.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59547.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59547.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52251.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22179.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54571.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32475.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21131.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27587.exe
        9⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55768.exe
        10⤵
        
        PID:8996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8446.exe
        10⤵
        
        PID:11240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47950.exe
        10⤵
        
        PID:14592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44807.exe
        10⤵
        
        PID:16648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32958.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:16420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35326.exe
        9⤵
        
        PID:8384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7749.exe
        9⤵
        
        PID:8524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31119.exe
        9⤵
        
        PID:11612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4029.exe
        9⤵
        
        PID:15536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33297.exe
        9⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59121.exe
        8⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19552.exe
        9⤵
        
        PID:8924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31134.exe
        9⤵
        
        PID:13412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17701.exe
        9⤵
        
        PID:16596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53352.exe
        9⤵
        
        PID:8068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        8⤵
        
        PID:8448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22453.exe
        8⤵
        
        PID:11652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53031.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56550.exe
        8⤵
        
        PID:8900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34129.exe
        7⤵
        Executes dropped EXE
        
        PID:4660
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 640
        8⤵
        Program crash
        
        PID:6528
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 640
        8⤵
        Program crash
        
        PID:5172
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 636
        8⤵
        Program crash
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15592.exe
        7⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59712.exe
        8⤵
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51679.exe
        8⤵
        
        PID:10928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45454.exe
        8⤵
        
        PID:14244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61039.exe
        8⤵
        
        PID:16780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53047.exe
        8⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5918.exe
        7⤵
        
        PID:8468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35333.exe
        7⤵
        
        PID:10836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2574.exe
        7⤵
        
        PID:14196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10439.exe
        7⤵
        
        PID:212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28945.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4986.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37099.exe
        8⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4927.exe
        9⤵
        
        PID:7612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32846.exe
        9⤵
        
        PID:10340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11158.exe
        9⤵
        
        PID:14972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22095.exe
        9⤵
        
        PID:18128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8902.exe
        8⤵
        
        PID:8280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46111.exe
        8⤵
        
        PID:11656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36317.exe
        8⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54199.exe
        8⤵
        
        PID:18048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4184.exe
        8⤵
        
        PID:8496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59121.exe
        7⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55192.exe
        8⤵
        
        PID:8436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15654.exe
        8⤵
        
        PID:10664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12397.exe
        8⤵
        
        PID:13996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58263.exe
        8⤵
        
        PID:17236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26430.exe
        8⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63583.exe
        7⤵
        
        PID:8376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        7⤵
        
        PID:11896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26222.exe
        7⤵
        
        PID:15288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52432.exe
        7⤵
        
        PID:17648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7350.exe
        7⤵
        
        PID:8452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22016.exe
        6⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44499.exe
        7⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14055.exe
        8⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16510.exe
        8⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19326.exe
        8⤵
        
        PID:14876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57993.exe
        8⤵
        
        PID:17328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        7⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32549.exe
        7⤵
        
        PID:10728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51319.exe
        7⤵
        
        PID:14272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37286.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45025.exe
        7⤵
        
        PID:8172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52594.exe
        6⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48280.exe
        7⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49967.exe
        7⤵
        
        PID:11872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23741.exe
        7⤵
        
        PID:16004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22678.exe
        7⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14549.exe
        6⤵
        
        PID:9044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3230.exe
        6⤵
        
        PID:11232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19359.exe
        6⤵
        
        PID:14648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48005.exe
        6⤵
        
        PID:3620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51215.exe
        6⤵
        
        PID:12476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2033.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65339.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36315.exe
        7⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35755.exe
        8⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5695.exe
        9⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16510.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:8620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43534.exe
        9⤵
        
        PID:14000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11454.exe
        9⤵
        
        PID:16428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28350.exe
        9⤵
        
        PID:16408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42342.exe
        8⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13246.exe
        8⤵
        
        PID:11700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34589.exe
        8⤵
        
        PID:14408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45838.exe
        8⤵
        
        PID:18080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24744.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40777.exe
        7⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62016.exe
        8⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51679.exe
        8⤵
        
        PID:10892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45454.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61039.exe
        8⤵
        
        PID:16804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14998.exe
        8⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7645.exe
        7⤵
        
        PID:8732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9982.exe
        7⤵
        
        PID:10900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19109.exe
        7⤵
        
        PID:1200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58911.exe
        7⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10624.exe
        7⤵
        
        PID:7716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41145.exe
        6⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60643.exe
        7⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59904.exe
        8⤵
        
        PID:7920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9302.exe
        8⤵
        
        PID:10992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45838.exe
        8⤵
        
        PID:13752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61039.exe
        8⤵
        
        PID:16788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33342.exe
        8⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41190.exe
        7⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13621.exe
        7⤵
        
        PID:12752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61303.exe
        7⤵
        
        PID:14588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42337.exe
        7⤵
        
        PID:17956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7424.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21753.exe
        6⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40600.exe
        7⤵
        
        PID:9472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22862.exe
        7⤵
        
        PID:12724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18365.exe
        7⤵
        
        PID:16328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61520.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55878.exe
        6⤵
        
        PID:2100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44366.exe
        6⤵
        
        PID:12292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62312.exe
        6⤵
        
        PID:15988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1840.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52651.exe
        6⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35947.exe
        7⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46344.exe
        8⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16510.exe
        8⤵
        
        PID:9560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19326.exe
        8⤵
        
        PID:14936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63704.exe
        8⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17646.exe
        7⤵
        
        PID:7456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48488.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56519.exe
        8⤵
        
        PID:15356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54702.exe
        8⤵
        
        PID:17756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53352.exe
        8⤵
        
        PID:15276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65414.exe
        7⤵
        
        PID:10920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51319.exe
        7⤵
        
        PID:14328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37286.exe
        7⤵
        
        PID:17944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61553.exe
        7⤵
        
        PID:5620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24825.exe
        6⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46344.exe
        7⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16510.exe
        7⤵
        
        PID:9480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11158.exe
        7⤵
        
        PID:15012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44759.exe
        7⤵
        
        PID:18356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53577.exe
        7⤵
        
        PID:17344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37927.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14285.exe
        6⤵
        
        PID:11476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28334.exe
        6⤵
        
        PID:15476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27910.exe
        6⤵
        
        PID:6508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3377.exe
        5⤵
        
        PID:1092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35947.exe
        6⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30008.exe
        7⤵
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16510.exe
        7⤵
        
        PID:10268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19326.exe
        7⤵
        
        PID:14944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5951.exe
        7⤵
        
        PID:6152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25046.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64454.exe
        6⤵
        
        PID:10364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18070.exe
        6⤵
        
        PID:13512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49598.exe
        6⤵
        
        PID:17220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36319.exe
        6⤵
        
        PID:7644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35568.exe
        5⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62208.exe
        6⤵
        
        PID:8340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32269.exe
        6⤵
        
        PID:11812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51231.exe
        6⤵
        
        PID:15248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51902.exe
        6⤵
        
        PID:17660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36319.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22902.exe
        5⤵
        
        PID:8820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43456.exe
        5⤵
        
        PID:10588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41253.exe
        5⤵
        
        PID:14412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24798.exe
        5⤵
        
        PID:16732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
        5⤵
        
        PID:17776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7482.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42179.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51219.exe
        7⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63139.exe
        8⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4943.exe
        9⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10558.exe
        9⤵
        
        PID:11336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47479.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:14376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19983.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:18136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3614.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22565.exe
        8⤵
        
        PID:11388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38814.exe
        8⤵
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32567.exe
        8⤵
        
        PID:17340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43465.exe
        7⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44056.exe
        8⤵
        
        PID:10164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61887.exe
        8⤵
        
        PID:13316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-981.exe
        8⤵
        
        PID:16560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61520.exe
        8⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17349.exe
        7⤵
        
        PID:9072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28431.exe
        7⤵
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18829.exe
        7⤵
        
        PID:14704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44302.exe
        7⤵
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47690.exe
        6⤵
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21147.exe
        7⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62592.exe
        8⤵
        
        PID:8752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55919.exe
        8⤵
        
        PID:10908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21909.exe
        8⤵
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18574.exe
        8⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1926.exe
        8⤵
        
        PID:18104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3614.exe
        7⤵
        
        PID:9064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22565.exe
        7⤵
        
        PID:11208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27495.exe
        7⤵
        
        PID:14716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36333.exe
        7⤵
        
        PID:17096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        7⤵
        
        PID:8396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7040.exe
        6⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46448.exe
        7⤵
        
        PID:8696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55919.exe
        7⤵
        
        PID:10952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21909.exe
        7⤵
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18574.exe
        7⤵
        
        PID:16984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23215.exe
        6⤵
        
        PID:9052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19765.exe
        6⤵
        
        PID:11188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2294.exe
        6⤵
        
        PID:14728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61368.exe
        6⤵
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55178.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34883.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21531.exe
        7⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2535.exe
        8⤵
        
        PID:7964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7189.exe
        8⤵
        
        PID:11724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59591.exe
        8⤵
        
        PID:15236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35565.exe
        8⤵
        
        PID:17676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9895.exe
        8⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58103.exe
        7⤵
        
        PID:8256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54928.exe
        8⤵
        
        PID:11860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31822.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54702.exe
        8⤵
        
        PID:17772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41624.exe
        8⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46111.exe
        7⤵
        
        PID:11664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36317.exe
        7⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54199.exe
        7⤵
        
        PID:18072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4376.exe
        7⤵
        
        PID:6512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3777.exe
        6⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53952.exe
        7⤵
        
        PID:9148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10558.exe
        7⤵
        
        PID:11372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21629.exe
        7⤵
        
        PID:14684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3966.exe
        7⤵
        
        PID:16436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8454.exe
        7⤵
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23509.exe
        6⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5455.exe
        7⤵
        
        PID:14344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64511.exe
        7⤵
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53927.exe
        7⤵
        
        PID:7724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21990.exe
        6⤵
        
        PID:11284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18829.exe
        6⤵
        
        PID:14696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44302.exe
        6⤵
        
        PID:16768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26961.exe
        6⤵
        
        PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45281.exe
        5⤵
        
        PID:4108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5578.exe
        6⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46536.exe
        7⤵
        
        PID:7424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16510.exe
        7⤵
        
        PID:10308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19326.exe
        7⤵
        
        PID:14928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33489.exe
        7⤵
        
        PID:10452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32830.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13246.exe
        6⤵
        
        PID:11956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42758.exe
        6⤵
        
        PID:15272
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15272 -s 464
        7⤵
        Program crash
        
        PID:16996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35366.exe
        6⤵
        
        PID:17736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45217.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62874.exe
        5⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53952.exe
        6⤵
        
        PID:9140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10558.exe
        6⤵
        
        PID:11408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37966.exe
        6⤵
        
        PID:14748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3966.exe
        6⤵
        
        PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30885.exe
        5⤵
        
        PID:9100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3230.exe
        5⤵
        
        PID:11352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19359.exe
        5⤵
        
        PID:14660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48005.exe
        5⤵
        
        PID:732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51215.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26048.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23377.exe
        5⤵
        
        PID:2544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37291.exe
        6⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22032.exe
        7⤵
        
        PID:7384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16510.exe
        7⤵
        
        PID:10300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19326.exe
        7⤵
        
        PID:14956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23208.exe
        7⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        6⤵
        
        PID:7476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13246.exe
        6⤵
        
        PID:11708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36317.exe
        6⤵
        
        PID:14472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17728.exe
        6⤵
        
        PID:7052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23184.exe
        5⤵
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22032.exe
        6⤵
        
        PID:7392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16510.exe
        6⤵
        
        PID:6576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11158.exe
        6⤵
        
        PID:15000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52815.exe
        5⤵
        
        PID:7780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61654.exe
        5⤵
        
        PID:10436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58407.exe
        5⤵
        
        PID:13812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58296.exe
        5⤵
        
        PID:17288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52990.exe
        5⤵
        
        PID:7808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17985.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44779.exe
        5⤵
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21635.exe
        6⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11855.exe
        7⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26982.exe
        7⤵
        
        PID:10800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45454.exe
        7⤵
        
        PID:14264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61039.exe
        7⤵
        
        PID:16748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28350.exe
        7⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41486.exe
        6⤵
        
        PID:7904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48222.exe
        6⤵
        
        PID:11688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43255.exe
        6⤵
        
        PID:424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51902.exe
        6⤵
        
        PID:17764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33247.exe
        6⤵
        
        PID:6808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47986.exe
        5⤵
        
        PID:6856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8783.exe
        6⤵
        
        PID:8164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2110.exe
        6⤵
        
        PID:12568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41614.exe
        6⤵
        
        PID:16356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4423.exe
        6⤵
        
        PID:18344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8646.exe
        6⤵
        
        PID:6028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43790.exe
        5⤵
        
        PID:9336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25935.exe
        5⤵
        
        PID:13304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15565.exe
        5⤵
        
        PID:16284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61016.exe
        5⤵
        
        PID:8772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3176.exe
      4⤵
      PID:2076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6377.exe
        5⤵
        
        PID:6860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11117.exe
        5⤵
        
        PID:9384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        5⤵
        
        PID:13644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56119.exe
        5⤵
        
        PID:17156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32913.exe
        5⤵
        
        PID:18248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32489.exe
      4⤵
      PID:6676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30984.exe
        5⤵
        
        PID:7876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3926.exe
        5⤵
        
        PID:11912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45558.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44231.exe
        5⤵
        
        PID:17636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40551.exe
        5⤵
        
        PID:6336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-767.exe
      4⤵
      PID:8680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49605.exe
      4⤵
      PID:12596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4502.exe
      4⤵
      PID:2896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57224.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:18376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48722.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48722.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6034.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40347.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50923.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1058.exe
        7⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31811.exe
        8⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30200.exe
        9⤵
        
        PID:7404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16510.exe
        9⤵
        
        PID:10292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11158.exe
        9⤵
        
        PID:14980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28165.exe
        9⤵
        
        PID:17852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59096.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        8⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55422.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22278.exe
        8⤵
        
        PID:16344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46462.exe
        8⤵
        
        PID:17996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4265.exe
        7⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48280.exe
        8⤵
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49967.exe
        8⤵
        
        PID:11348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40951.exe
        8⤵
        
        PID:14516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28542.exe
        8⤵
        
        PID:8872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3037.exe
        7⤵
        
        PID:8664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13734.exe
        7⤵
        
        PID:12584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30837.exe
        7⤵
        
        PID:216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8063.exe
        7⤵
        
        PID:18192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38753.exe
        6⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55739.exe
        7⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6612 -s 632
        8⤵
        Program crash
        
        PID:8712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25534.exe
        7⤵
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48222.exe
        7⤵
        
        PID:11604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44983.exe
        7⤵
        
        PID:14452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15847.exe
        7⤵
        
        PID:7036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18000.exe
        6⤵
        
        PID:7084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8902.exe
        6⤵
        
        PID:8704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5069.exe
        6⤵
        
        PID:12608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14302.exe
        6⤵
        
        PID:3388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47521.exe
        6⤵
        
        PID:5824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29713.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44011.exe
        6⤵
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5298.exe
        7⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38088.exe
        8⤵
        
        PID:8672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55919.exe
        8⤵
        
        PID:10944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21909.exe
        8⤵
        
        PID:14240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18574.exe
        8⤵
        
        PID:16740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20374.exe
        8⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8621.exe
        7⤵
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6910.exe
        7⤵
        
        PID:12892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46894.exe
        7⤵
        
        PID:15892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36319.exe
        7⤵
        
        PID:7680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14161.exe
        6⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25416.exe
        7⤵
        
        PID:9424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14502.exe
        7⤵
        
        PID:12772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18365.exe
        7⤵
        
        PID:14200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41624.exe
        7⤵
        
        PID:10504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-453.exe
        6⤵
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6910.exe
        6⤵
        
        PID:12952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46894.exe
        6⤵
        
        PID:15884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52656.exe
        6⤵
        
        PID:8092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48161.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29803.exe
        6⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2535.exe
        7⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7189.exe
        7⤵
        
        PID:11616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44983.exe
        7⤵
        
        PID:1472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5197.exe
        7⤵
        
        PID:18024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39199.exe
        7⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26966.exe
        6⤵
        
        PID:8320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56286.exe
        6⤵
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
        6⤵
        
        PID:4676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57766.exe
        6⤵
        
        PID:17280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        6⤵
        
        PID:16772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25402.exe
        5⤵
        
        PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5629.exe
        5⤵
        
        PID:6640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55607.exe
        5⤵
        
        PID:12960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47424.exe
        5⤵
        
        PID:15768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40022.exe
        5⤵
        
        PID:3304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45178.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49579.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19123.exe
        6⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5298.exe
        7⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47128.exe
        8⤵
        
        PID:8384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3350.exe
        8⤵
        
        PID:11560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47670.exe
        8⤵
        
        PID:15468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12518.exe
        8⤵
        
        PID:18164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36390.exe
        7⤵
        
        PID:8980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14501.exe
        7⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32285.exe
        7⤵
        
        PID:15284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34591.exe
        7⤵
        
        PID:17812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55014.exe
        6⤵
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2374.exe
        6⤵
        
        PID:9944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56102.exe
        6⤵
        
        PID:10124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        6⤵
        
        PID:16464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61745.exe
        6⤵
        
        PID:7288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40289.exe
        5⤵
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21635.exe
        6⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59904.exe
        7⤵
        
        PID:7928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7189.exe
        7⤵
        
        PID:11676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44983.exe
        7⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16807.exe
        7⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49743.exe
        6⤵
        
        PID:8240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31589.exe
        6⤵
        
        PID:11220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
        6⤵
        
        PID:13464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49598.exe
        6⤵
        
        PID:4880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe
        6⤵
        
        PID:6980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58457.exe
        5⤵
        
        PID:6432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32240.exe
        6⤵
        
        PID:9452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14502.exe
        6⤵
        
        PID:12748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18365.exe
        6⤵
        
        PID:14128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53352.exe
        6⤵
        
        PID:8416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14486.exe
        5⤵
        
        PID:9028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6605.exe
        5⤵
        
        PID:12908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30358.exe
        5⤵
        
        PID:15712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2456.exe
        5⤵
        
        PID:7712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10776.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45739.exe
        5⤵
        
        PID:3532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
        6⤵
        
        PID:7172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52063.exe
        6⤵
        
        PID:8044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40734.exe
        6⤵
        
        PID:14112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51791.exe
        6⤵
        
        PID:16396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28881.exe
        6⤵
        
        PID:8364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38678.exe
        5⤵
        
        PID:6548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24368.exe
        6⤵
        
        PID:12260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25574.exe
        6⤵
        
        PID:14988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29040.exe
        6⤵
        
        PID:8832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27445.exe
        5⤵
        
        PID:9892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16030.exe
        5⤵
        
        PID:14036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3319.exe
        5⤵
        
        PID:16524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31854.exe
        5⤵
        
        PID:18112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62386.exe
      4⤵
      PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14545.exe
        5⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52176.exe
        6⤵
        
        PID:17112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22023.exe
        6⤵
        
        PID:11696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60318.exe
        5⤵
        
        PID:9364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        5⤵
        
        PID:13632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
        5⤵
        
        PID:17116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25705.exe
        5⤵
        
        PID:5868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16736.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46654.exe
      4⤵
      PID:8544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7135.exe
      4⤵
      PID:12968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25893.exe
      4⤵
      PID:16136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2015.exe
      4⤵
      PID:8476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31232.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31232.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56875.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25651.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6434.exe
        6⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64011.exe
        7⤵
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60231.exe
        7⤵
        
        PID:8520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9405.exe
        7⤵
        
        PID:12944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55559.exe
        7⤵
        
        PID:15872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26430.exe
        7⤵
        
        PID:17540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64322.exe
        6⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7543.exe
        7⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3646.exe
        7⤵
        
        PID:13024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18365.exe
        7⤵
        
        PID:16224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27453.exe
        6⤵
        
        PID:9288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25935.exe
        6⤵
        
        PID:13292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15565.exe
        6⤵
        
        PID:16272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3839.exe
        6⤵
        
        PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
        5⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21368.exe
        6⤵
        
        PID:8304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42550.exe
        6⤵
        
        PID:9608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12205.exe
        6⤵
        
        PID:14300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58263.exe
        6⤵
        
        PID:3524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22061.exe
        5⤵
        
        PID:7900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5742.exe
        5⤵
        
        PID:10872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42654.exe
        5⤵
        
        PID:13368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35838.exe
        5⤵
        
        PID:16856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26961.exe
        5⤵
        
        PID:5172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30289.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4514.exe
        5⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41619.exe
        6⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1807.exe
        7⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48455.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31150.exe
        7⤵
        
        PID:8692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38030.exe
        6⤵
        
        PID:9632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50158.exe
        6⤵
        
        PID:11424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15294.exe
        6⤵
        
        PID:2764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28350.exe
        6⤵
        
        PID:6428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30881.exe
        5⤵
        
        PID:6956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29272.exe
        6⤵
        
        PID:11196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9518.exe
        6⤵
        
        PID:14580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38942.exe
        6⤵
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49216.exe
        6⤵
        
        PID:6324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11117.exe
        5⤵
        
        PID:9400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34103.exe
        5⤵
        
        PID:12632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15565.exe
        5⤵
        
        PID:16212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27959.exe
        5⤵
        
        PID:7700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17216.exe
      4⤵
      PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30008.exe
        5⤵
        
        PID:7296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65400.exe
        6⤵
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17598.exe
        6⤵
        
        PID:15400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15199.exe
        6⤵
        
        PID:17080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16510.exe
        5⤵
        
        PID:9344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19326.exe
        5⤵
        
        PID:14892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23208.exe
        5⤵
        
        PID:5708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37247.exe
      4⤵
      PID:7256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53102.exe
      4⤵
      PID:10592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58407.exe
      4⤵
      PID:14192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17263.exe
      4⤵
      PID:17192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15769.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15769.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33435.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37571.exe
        5⤵
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29803.exe
        6⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33688.exe
        7⤵
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39302.exe
        7⤵
        
        PID:13404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42398.exe
        7⤵
        
        PID:16708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61520.exe
        7⤵
        
        PID:8052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20054.exe
        6⤵
        
        PID:8956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14501.exe
        6⤵
        
        PID:1832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24117.exe
        6⤵
        
        PID:1076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5225.exe
        5⤵
        
        PID:6552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40704.exe
        6⤵
        
        PID:11276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1070.exe
        6⤵
        
        PID:15372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25864.exe
        6⤵
        
        PID:7128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60126.exe
        5⤵
        
        PID:9236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1238.exe
        5⤵
        
        PID:13252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15565.exe
        5⤵
        
        PID:16252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26065.exe
      4⤵
      PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5298.exe
        5⤵
        
        PID:6876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23408.exe
        6⤵
        
        PID:12156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8854.exe
        6⤵
        
        PID:15772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31230.exe
        6⤵
        
        PID:18316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12319.exe
        6⤵
        
        PID:17304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44943.exe
        5⤵
        
        PID:9080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63702.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29607.exe
        5⤵
        
        PID:16064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27896.exe
      4⤵
      PID:6396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6127.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27510.exe
        5⤵
        
        PID:16944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1166.exe
        5⤵
        
        PID:18084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14294.exe
      4⤵
      PID:9204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6605.exe
      4⤵
      PID:12876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30358.exe
      4⤵
      PID:15980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25705.exe
      4⤵
      PID:6100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57369.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57369.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25977.exe
      4⤵
      PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2535.exe
        5⤵
        
        PID:7976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51679.exe
        5⤵
        
        PID:10884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45454.exe
        5⤵
        
        PID:14292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61039.exe
        5⤵
        
        PID:16796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32958.exe
        5⤵
        
        PID:18280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50406.exe
      4⤵
      PID:8864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51591.exe
      4⤵
      PID:10556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62254.exe
      4⤵
      PID:14400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18262.exe
      4⤵
      PID:9728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28881.exe
      4⤵
      PID:8456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38913.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38913.exe
    3⤵
    PID:5584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52063.exe
      4⤵
      PID:9616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59663.exe
      4⤵
      PID:14964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28696.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:17448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11958.exe
      4⤵
      PID:17292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16690.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16690.exe
    3⤵
    PID:2844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16880.exe
      4⤵
      PID:13096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4630.exe
      4⤵
      PID:1988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53543.exe
      4⤵
      PID:5140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27965.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27965.exe
    3⤵
    PID:7984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31774.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31774.exe
    3⤵
    PID:11684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58967.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58967.exe
    3⤵
    PID:1128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11343.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11343.exe
    3⤵
    PID:8744
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56018.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56018.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3050.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3050.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55043.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7674.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33627.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53331.exe
        7⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49875.exe
        8⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13303.exe
        9⤵
        
        PID:8348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18918.exe
        9⤵
        
        PID:11468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37966.exe
        9⤵
        
        PID:14768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3966.exe
        9⤵
        
        PID:17380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20374.exe
        9⤵
        
        PID:8860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35814.exe
        8⤵
        
        PID:8360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25829.exe
        8⤵
        
        PID:11888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51423.exe
        8⤵
        
        PID:15324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51902.exe
        8⤵
        
        PID:17744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        8⤵
        
        PID:8296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61826.exe
        7⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32344.exe
        8⤵
        
        PID:12216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64494.exe
        8⤵
        
        PID:14724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41048.exe
        8⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44070.exe
        7⤵
        
        PID:8852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5374.exe
        7⤵
        
        PID:12552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38814.exe
        7⤵
        
        PID:16368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25321.exe
        7⤵
        
        PID:17296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60274.exe
        6⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7026.exe
        7⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35888.exe
        8⤵
        
        PID:10156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61887.exe
        8⤵
        
        PID:13240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-981.exe
        8⤵
        
        PID:16552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17119.exe
        8⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27558.exe
        7⤵
        
        PID:8312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9405.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55559.exe
        7⤵
        
        PID:16156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe
        7⤵
        
        PID:8048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12520.exe
        6⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        7⤵
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31134.exe
        7⤵
        
        PID:13396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42398.exe
        7⤵
        
        PID:16692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49792.exe
        7⤵
        
        PID:8016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33319.exe
        6⤵
        
        PID:9300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17269.exe
        6⤵
        
        PID:11600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64567.exe
        6⤵
        
        PID:16324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38457.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4514.exe
        6⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5298.exe
        7⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54736.exe
        8⤵
        
        PID:11636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25382.exe
        8⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7997.exe
        8⤵
        
        PID:18064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44992.exe
        8⤵
        
        PID:7880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44943.exe
        7⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63702.exe
        7⤵
        
        PID:12304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32285.exe
        7⤵
        
        PID:15152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24015.exe
        7⤵
        
        PID:6792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63170.exe
        6⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34856.exe
        7⤵
        
        PID:13580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38366.exe
        7⤵
        
        PID:17128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6454.exe
        7⤵
        
        PID:8120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-453.exe
        6⤵
        
        PID:8656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15270.exe
        6⤵
        
        PID:13004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46894.exe
        6⤵
        
        PID:1236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8639.exe
        6⤵
        
        PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15401.exe
        5⤵
        
        PID:6400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13007.exe
        6⤵
        
        PID:6704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18814.exe
        6⤵
        
        PID:10772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45454.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61039.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42575.exe
        6⤵
        
        PID:6420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53574.exe
        5⤵
        
        PID:7412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23087.exe
        5⤵
        
        PID:12508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17813.exe
        5⤵
        
        PID:16380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45327.exe
        5⤵
        
        PID:5572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20673.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9314.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7010.exe
        6⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56256.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-766.exe
        7⤵
        
        PID:11824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64582.exe
        7⤵
        
        PID:16056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1926.exe
        7⤵
        
        PID:7376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40230.exe
        6⤵
        
        PID:7884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22182.exe
        6⤵
        
        PID:11496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35165.exe
        6⤵
        
        PID:14760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44302.exe
        6⤵
        
        PID:1204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53577.exe
        6⤵
        
        PID:17332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8489.exe
        5⤵
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16848.exe
        6⤵
        
        PID:6568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23422.exe
        6⤵
        
        PID:9704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8165.exe
        6⤵
        
        PID:13212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6078.exe
        6⤵
        
        PID:16988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16093.exe
        5⤵
        
        PID:7480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36111.exe
        5⤵
        
        PID:6572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51495.exe
        5⤵
        
        PID:14992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28696.exe
        5⤵
        
        PID:17456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64911.exe
        5⤵
        
        PID:6472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45753.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7010.exe
        5⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51515.exe
        6⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62904.exe
        7⤵
        
        PID:11748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23654.exe
        7⤵
        
        PID:14352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38366.exe
        7⤵
        
        PID:17684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35096.exe
        7⤵
        
        PID:1188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21886.exe
        6⤵
        
        PID:9316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20069.exe
        6⤵
        
        PID:11788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24231.exe
        6⤵
        
        PID:16240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22254.exe
        5⤵
        
        PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28413.exe
        5⤵
        
        PID:9584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56023.exe
        5⤵
        
        PID:12484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6629.exe
        5⤵
        
        PID:15728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52848.exe
        5⤵
        
        PID:5840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14145.exe
      4⤵
      PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46536.exe
        5⤵
        
        PID:7432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40512.exe
        6⤵
        
        PID:11304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17598.exe
        6⤵
        
        PID:15412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31152.exe
        6⤵
        
        PID:18148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16510.exe
        5⤵
        
        PID:10316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19326.exe
        5⤵
        
        PID:14900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28881.exe
        5⤵
        
        PID:6372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4269.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21382.exe
      4⤵
      PID:10808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43184.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31373.exe
      4⤵
      PID:16864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2505.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2505.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65235.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3532
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 488
        5⤵
        Program crash
        
        PID:732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57098.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46507.exe
        5⤵
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2314.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37736.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59783.exe
        7⤵
        
        PID:15844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31230.exe
        7⤵
        
        PID:18332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30054.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28237.exe
        6⤵
        
        PID:12544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24231.exe
        6⤵
        
        PID:3672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55578.exe
        5⤵
        
        PID:7156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11117.exe
        5⤵
        
        PID:9392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        5⤵
        
        PID:13612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
        5⤵
        
        PID:17136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36857.exe
        5⤵
        
        PID:8760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63449.exe
      4⤵
      PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30392.exe
        5⤵
        
        PID:7496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16510.exe
        5⤵
        
        PID:3360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35366.exe
        5⤵
        
        PID:14076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11454.exe
        5⤵
        
        PID:16392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28695.exe
      4⤵
      PID:8072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56120.exe
        5⤵
        
        PID:16528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29749.exe
      4⤵
      PID:10720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26118.exe
      4⤵
      PID:14304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32821.exe
      4⤵
      PID:17976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49295.exe
      4⤵
      PID:2312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18072.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18072.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17483.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55635.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
        6⤵
        
        PID:6768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52063.exe
        6⤵
        
        PID:8912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40734.exe
        6⤵
        
        PID:14120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51791.exe
        6⤵
        
        PID:16512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38678.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2566.exe
        5⤵
        
        PID:9972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56102.exe
        5⤵
        
        PID:13232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        5⤵
        
        PID:16440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53385.exe
        5⤵
        
        PID:7416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58074.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58074.exe
      4⤵
      PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13863.exe
        5⤵
        
        PID:7464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16510.exe
        5⤵
        
        PID:10280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19326.exe
        5⤵
        
        PID:14912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13927.exe
        5⤵
        
        PID:5704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31381.exe
      4⤵
      PID:7260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45239.exe
      4⤵
      PID:11032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17189.exe
      4⤵
      PID:14060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34686.exe
      4⤵
      PID:17004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20712.exe
      4⤵
      PID:8908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51618.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51618.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14602.exe
      4⤵
      PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7218.exe
        5⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32240.exe
        6⤵
        
        PID:9444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14502.exe
        6⤵
        
        PID:12592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18365.exe
        6⤵
        
        PID:16260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35096.exe
        6⤵
        
        PID:17816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60423.exe
        5⤵
        
        PID:2276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9405.exe
        5⤵
        
        PID:12900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55559.exe
        5⤵
        
        PID:15864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8838.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14161.exe
      4⤵
      PID:6348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32536.exe
        5⤵
        
        PID:11316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1070.exe
        5⤵
        
        PID:15516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39320.exe
        5⤵
        
        PID:6180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-453.exe
      4⤵
      PID:8420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15270.exe
      4⤵
      PID:12992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46894.exe
      4⤵
      PID:16000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36319.exe
      4⤵
      PID:8148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46513.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46513.exe
    3⤵
    PID:5848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57304.exe
      4⤵
      PID:5592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14870.exe
      4⤵
      PID:9656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41990.exe
      4⤵
      PID:816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15294.exe
      4⤵
      PID:4272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20374.exe
      4⤵
      PID:8920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61911.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61911.exe
    3⤵
    PID:7264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27976.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27976.exe
    3⤵
    PID:7708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11565.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11565.exe
    3⤵
    PID:13972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41990.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41990.exe
    3⤵
    PID:16484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45327.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45327.exe
    3⤵
    PID:5692
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13448.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13448.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44026.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44026.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9786.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63419.exe
        6⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9447.exe
        7⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47543.exe
        7⤵
        
        PID:9620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41990.exe
        7⤵
        
        PID:12332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15294.exe
        7⤵
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59295.exe
        7⤵
        
        PID:7656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59727.exe
        6⤵
        
        PID:7540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30245.exe
        6⤵
        
        PID:8464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41231.exe
        6⤵
        
        PID:14016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2789.exe
        6⤵
        
        PID:16448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3839.exe
        6⤵
        
        PID:8964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49522.exe
        5⤵
        
        PID:5996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62120.exe
        6⤵
        
        PID:9180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49863.exe
        6⤵
        
        PID:11260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21629.exe
        6⤵
        
        PID:14676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3966.exe
        6⤵
        
        PID:1968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33254.exe
        6⤵
        
        PID:17900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30613.exe
        5⤵
        
        PID:8204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12758.exe
        5⤵
        
        PID:11176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17573.exe
        5⤵
        
        PID:14068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33062.exe
        5⤵
        
        PID:17252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56330.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:60
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61411.exe
        5⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13095.exe
        6⤵
        
        PID:7632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41206.exe
        6⤵
        
        PID:10372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19326.exe
        6⤵
        
        PID:14884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53385.exe
        6⤵
        
        PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        5⤵
        
        PID:3840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22557.exe
        5⤵
        
        PID:12500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22278.exe
        5⤵
        
        PID:14872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24744.exe
        5⤵
        
        PID:6456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39137.exe
      4⤵
      PID:1396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30008.exe
        5⤵
        
        PID:7280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16510.exe
        5⤵
        
        PID:6696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43534.exe
        5⤵
        
        PID:14148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11454.exe
        5⤵
        
        PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28542.exe
        5⤵
        
        PID:8856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4190.exe
      4⤵
      PID:8132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33880.exe
        5⤵
        
        PID:9328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38726.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9917.exe
        5⤵
        
        PID:17168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23368.exe
        5⤵
        
        PID:1680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29749.exe
      4⤵
      PID:10748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26118.exe
      4⤵
      PID:14280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52904.exe
      4⤵
      PID:16956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48382.exe
      4⤵
      PID:8940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11824.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11824.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2490.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22579.exe
        5⤵
        
        PID:5768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62872.exe
        6⤵
        
        PID:7352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61288.exe
        7⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4646.exe
        7⤵
        
        PID:16520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35759.exe
        7⤵
        
        PID:16412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16510.exe
        6⤵
        
        PID:6624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11158.exe
        6⤵
        
        PID:14856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60838.exe
        6⤵
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        6⤵
        
        PID:17672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58871.exe
        5⤵
        
        PID:7552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13246.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34589.exe
        5⤵
        
        PID:14644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53385.exe
        5⤵
        
        PID:8088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8489.exe
      4⤵
      PID:5924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-586.exe
        5⤵
        
        PID:6700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14279.exe
        6⤵
        
        PID:11548
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6700 -s 632
        6⤵
        Program crash
        
        PID:14108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62727.exe
        5⤵
        
        PID:9256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60910.exe
        5⤵
        
        PID:13272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24231.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35990.exe
      4⤵
      PID:6740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34279.exe
      4⤵
      PID:9600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47358.exe
      4⤵
      PID:13248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55631.exe
      4⤵
      PID:16144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18561.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18561.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46699.exe
      4⤵
      PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18384.exe
        5⤵
        
        PID:1880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33688.exe
        6⤵
        
        PID:376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39302.exe
        6⤵
        
        PID:13384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42398.exe
        6⤵
        
        PID:16700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37208.exe
        6⤵
        
        PID:12252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24958.exe
        5⤵
        
        PID:9908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27189.exe
        5⤵
        
        PID:12516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49031.exe
        5⤵
        
        PID:17244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11822.exe
        5⤵
        
        PID:7784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64543.exe
      4⤵
      PID:7860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31408.exe
        5⤵
        
        PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14239.exe
        5⤵
        
        PID:5156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40718.exe
      4⤵
      PID:10844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51319.exe
      4⤵
      PID:14256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52374.exe
      4⤵
      PID:16940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11815.exe
      4⤵
      PID:8584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27592.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27592.exe
    3⤵
    PID:5944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46344.exe
      4⤵
      PID:7340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16510.exe
      4⤵
      PID:10324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11158.exe
      4⤵
      PID:14920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4184.exe
      4⤵
      PID:7792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61439.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61439.exe
    3⤵
    PID:7788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38448.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38448.exe
    3⤵
    PID:10856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21653.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21653.exe
    3⤵
    PID:1324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
    3⤵
    PID:16880
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37098.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37098.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40539.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40539.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17099.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53523.exe
        5⤵
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46907.exe
        6⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62120.exe
        7⤵
        
        PID:9176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49863.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13077.exe
        7⤵
        
        PID:14636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12134.exe
        7⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61023.exe
        7⤵
        
        PID:7828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59935.exe
        6⤵
        
        PID:8564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17085.exe
        6⤵
        
        PID:11624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53535.exe
        6⤵
        
        PID:15484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24399.exe
        6⤵
        
        PID:6256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5801.exe
        5⤵
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48680.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50079.exe
        6⤵
        
        PID:14600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63824.exe
        6⤵
        
        PID:18088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-453.exe
        5⤵
        
        PID:8836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15270.exe
        5⤵
        
        PID:13088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15565.exe
        5⤵
        
        PID:14008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        5⤵
        
        PID:7732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19241.exe
      4⤵
      PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41619.exe
        5⤵
        
        PID:6644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48680.exe
        6⤵
        
        PID:12180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41910.exe
        6⤵
        
        PID:1972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7997.exe
        6⤵
        
        PID:18036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29040.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38030.exe
        5⤵
        
        PID:1432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60910.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24231.exe
        5⤵
        
        PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25174.exe
        5⤵
        
        PID:5820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61145.exe
      4⤵
      PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-823.exe
        5⤵
        
        PID:4472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39302.exe
        5⤵
        
        PID:13420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42398.exe
        5⤵
        
        PID:16716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16982.exe
      4⤵
      PID:9408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25437.exe
      4⤵
      PID:12432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64567.exe
      4⤵
      PID:1648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53385.exe
      4⤵
      PID:8040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46626.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46626.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30939.exe
      4⤵
      PID:5396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5298.exe
        5⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63568.exe
        6⤵
        
        PID:8368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61207.exe
        6⤵
        
        PID:12976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49694.exe
        6⤵
        
        PID:16148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35096.exe
        6⤵
        
        PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44943.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63702.exe
        5⤵
        
        PID:1288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4910.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11815.exe
        5⤵
        
        PID:6828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47986.exe
      4⤵
      PID:6932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2887.exe
        5⤵
        
        PID:4920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10925.exe
      4⤵
      PID:9264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1238.exe
      4⤵
      PID:13264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15565.exe
      4⤵
      PID:16244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15401.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15401.exe
    3⤵
    PID:6408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29536.exe
      4⤵
      PID:8128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7189.exe
      4⤵
      PID:11792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59591.exe
      4⤵
      PID:15228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35565.exe
      4⤵
      PID:17692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9023.exe
      4⤵
      PID:7060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53574.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53574.exe
    3⤵
    PID:7624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62327.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62327.exe
    3⤵
    PID:11296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13575.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13575.exe
    3⤵
    PID:12648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18197.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18197.exe
    3⤵
    PID:4168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7391.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7391.exe
    3⤵
    PID:2984
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56305.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56305.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9122.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9122.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14602.exe
      4⤵
      PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5237.exe
        5⤵
        
        PID:7180
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7180 -s 472
        6⤵
        Program crash
        
        PID:8164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58207.exe
        5⤵
        
        PID:9720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13533.exe
        5⤵
        
        PID:13100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13550.exe
        5⤵
        
        PID:16868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26193.exe
        5⤵
        
        PID:6652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38678.exe
      4⤵
      PID:6948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58119.exe
      4⤵
      PID:8800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50238.exe
      4⤵
      PID:13372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23062.exe
      4⤵
      PID:16608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20904.exe
      4⤵
      PID:5248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49522.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49522.exe
    3⤵
    PID:6004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42120.exe
      4⤵
      PID:6660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15624.exe
        5⤵
        
        PID:12068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39606.exe
        5⤵
        
        PID:15676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7031.exe
        5⤵
        
        PID:17696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14678.exe
      4⤵
      PID:9568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41990.exe
      4⤵
      PID:13288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15294.exe
      4⤵
      PID:4016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25174.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23877.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23877.exe
    3⤵
    PID:7312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36111.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36111.exe
    3⤵
    PID:372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32565.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32565.exe
    3⤵
    PID:14096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51791.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51791.exe
    3⤵
    PID:16472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20904.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20904.exe
    3⤵
    PID:8848
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24689.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24689.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42505.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42505.exe
    3⤵
    PID:6192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59904.exe
      4⤵
      PID:7912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25830.exe
      4⤵
      PID:10400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12205.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-894.exe
      4⤵
      PID:17268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26430.exe
      4⤵
      PID:5524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42238.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42238.exe
    3⤵
    PID:8840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51591.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51591.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:10976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62254.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62254.exe
    3⤵
    PID:14424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34598.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34598.exe
    3⤵
    PID:2548
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14946.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14946.exe
  2⤵
  PID:5556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18576.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18576.exe
    3⤵
    PID:6840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62520.exe
      4⤵
      PID:11760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64495.exe
      4⤵
      PID:14952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41624.exe
      4⤵
      PID:6136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48311.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48311.exe
    3⤵
    PID:9936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42566.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42566.exe
    3⤵
    PID:13132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41527.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41527.exe
    3⤵
    PID:16452
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38141.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38141.exe
  2⤵
  PID:7948
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3414.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3414.exe
  2⤵
  PID:10704
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20518.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20518.exe
  2⤵
  PID:13360
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2502.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2502.exe
  2⤵
  PID:16684
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23895.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23895.exe
  2⤵
  PID:1176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3532 -ip 3532
1⤵
PID:3604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4660 -ip 4660
1⤵
PID:5988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4660 -ip 4660
1⤵
PID:5412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4660 -ip 4660
1⤵
PID:1540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 7180 -ip 7180
1⤵
PID:7672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 6612 -ip 6612
1⤵
PID:8572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 6700 -ip 6700
1⤵
PID:13464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 15272 -ip 15272
1⤵
PID:16684

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:18016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11824.exe

Filesize
184KB

MD5
09ebf5c7577f489e52ebe3132cddf687

SHA1
18d0cf9249cad83d55b75dbfb1fb0e3aa66190f6

SHA256
a9fc3d85c492a5e1ef4892a455ea32e565bbe2c262359491378e71f0b2b5a6e9

SHA512
e1becd8d94298a1896eac131926e0793a6572305e40f27f624bcea14c3d63abfa975701162e4c0e701a4b0793bf74128785f439dc159ce789905de7d49b8a983

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13448.exe

Filesize
184KB

MD5
88818c1953d2b576456a389e33757a03

SHA1
4f7fb66c3f040fa85a99544c0308d23e7cfc503e

SHA256
6a7fe82699743789e245140901dad87af54df78b8272e2760bcb6a2fd35ce051

SHA512
8d5e830e7427465c016cbd11e507f046ac2da46b16bb3ac0e680270d56637e045c3bb4bee3791abea57f92b191e9543f3c138afed326f558204a190606bacfcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15769.exe

Filesize
184KB

MD5
a80b9692925bb231d60f054b71aee718

SHA1
b03878a9dc1adfdbca803bb3696141dda0930e2f

SHA256
91d2b01c1b14926f9f7917ef849242cc7f3b7aff3b71d729e3b68551c6531a23

SHA512
fdafdbdee38949d75b769d0d4297fcfc885880fbab7ed21f1df89c2aa8fe044e4dc5124ff7619246178f8205e1d32af431dcd5840511fe342b5044243ba8b5e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18072.exe

Filesize
184KB

MD5
2c0e04ac2ab3ae2698c9d1704ebc49d4

SHA1
402b2342a887101304109bfda609e4afa094df76

SHA256
62fec41e6086a3228b7bdb78a75f2685db3130fb610f19d69f1291a574a3a9b6

SHA512
5638f80532adf47e19a3c9ecdea75bed2ded1b486d61e3173fa3f6af647612a7e07b1a776656f10ed3043909c26b937c5ec56c1b21711b2ac33c7329f41c7f8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2033.exe

Filesize
184KB

MD5
5983467cafc6f2b7161eb4e0958eee89

SHA1
87e962a675e19042872aa8eed9c283c942fbb6ae

SHA256
0dc91a65e50e32e7a8d7f78974192267e3bba20b24973b913642bfeab6bbca9a

SHA512
9a37d8f39c01367b2015bec191db7a8b522d953247f8ea30ac58a7e6189050225f98ef38ccf8fc88f034a710ed8a3da8647efd56996f8c5820a20d7e7c64b834

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20673.exe

Filesize
184KB

MD5
97b744d1ed781956af9db84476cac689

SHA1
28b896641b6b2bd6d8438e2b9d5d3a5fac04e1a4

SHA256
fb91bb73aaaea78210bacaed981723a510cf64c84174b05820d818aa37333fbd

SHA512
b71ddc7df8119b4e8ddf84dbd5c7621d3e35096317dae72b02f722f4d46e13cf775240cc723d90131cc3cad13c897d2ddf3e3ea69b308ba076687106b39d6e59

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21635.exe

Filesize
184KB

MD5
7943facaa8bbf48b7868e94a00e7524f

SHA1
fb751f5bd020e780fe8daa35684c66a04acd4fa0

SHA256
1335fa55de275f49f13ffa035ec77f0746e1b4dc27328df623ec2ed04138e180

SHA512
bd25634cd37120255406d210b096fbe04d47c5a8671965d0d21ef0f19ebd3e5d4e834f752491ff3b2788836c2c9bbb49d3bffe94993dd0fcae34a3283269cc41

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22179.exe

Filesize
184KB

MD5
46fbf8d84742eb224649549db583aec2

SHA1
2ee4a6344466af1eb4c08a469de8db7bdb957b05

SHA256
f91d02211587441c975aa0be05269cfd8b9fe1ac897adbffa404f319ef15de15

SHA512
65f7ecb1abdaa1d7d02c7ca980fdc13b1450b5e7fd505dd8734f58eda182b4f3ac8ad4bd56d941f51fd7240d75fefeb4fe718361f0d5564e450fe36dac0416db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22579.exe

Filesize
184KB

MD5
7e219d347dec0064423806405ebea708

SHA1
cf914f0967067dd2520fa76eba0529dc857197a0

SHA256
d16ebf26d7606ed009fce9f20e6b704d060dd7b4308d1ea832f91d14b595695c

SHA512
4a64f4465c29c985437f931faa30962f3c93728d21e64e5976821f76c6e285f561f63e78dbc9dc8f1b86889f55a5aa2654c20c93e8c452d807411e834fef60d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23741.exe

Filesize
184KB

MD5
384c5719d2dfd38faf1678a0e874fba1

SHA1
20024e9dd1dbb1a6dc94fc512e0741a969aba79f

SHA256
b68bd896f8413d71f9a1a67b4d60c4b8e9153aa0c825506b550115c19fa97817

SHA512
2cf68fe4a945774414d2296f8151676c33cb3d15fe8bb6a01fb125457d1b5741ad489c8014ef366dde55e6fccc4fd2d7ebc54fa03c84ae704602229f16352dea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2505.exe

Filesize
184KB

MD5
91ade81b06e7967e93cbad0eff1ba169

SHA1
d5bd5e23bff9c7137c8aafbbd1c214205fba96d2

SHA256
aa3a2764b2d8b1acde380895be350e0002e8fe0a1577214b1442dc03e15e20a9

SHA512
0e6fb93355b8dc6ab8102746e9a4f6966caec4c3e7cf7452227ebbf834657c1234c8b6043622d2549c91d2996067d9a9d9f412720b768d28ddc24f3dff185469

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26048.exe

Filesize
184KB

MD5
e9dd4fe060a08e24ff0cf81b578bcfe1

SHA1
57ee63a38ca350a6d90857aa34a86b44e1772e7d

SHA256
964e2e3cc11854dcce1c2f863c576909e1af1ee837f203f3261c680b95eee148

SHA512
55cc5500bf5e58302ac4f29e20c746339cb759ccd07b28c4f1a2ab82a11085c40f66584756104ad59954a20477304680ca8d83a8e6e671ae53367bf72f2247cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe

Filesize
184KB

MD5
c21d8fd05eea2d55f3bf4f19ead7a4d5

SHA1
5b710a27af5af2c7732ba2dc7339951ab636e46d

SHA256
783a99aaf5da2d3828d1cfa2060e736b67e89d7b1a271d19116ccd51470da6f4

SHA512
d0d0dc7d08c4cea1d0d3f164b656384d8a5ade00309e348ab512c34c935756f7701fcaf474335dc155cc44140bd18ad5282a4c3ba7b2bd3b4eaf1e3bfb4a4f0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3050.exe

Filesize
184KB

MD5
3e010b7b818e891f8e734c3f0efbec9e

SHA1
bec489ba6abef887336772ec5d5d1b990708c85e

SHA256
0a3344ab5fc4481177e6672894ce595df25ddd94b22b760406752d8261cf9e43

SHA512
4c8972ff239d0e811e99a76766cee77109df84f5c8c2b233c3cdacbc05fae0e651bf9ef1f17bc64d4d46d0bcb75145fa9b757f1854e499ec890fa74584cc8369

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31134.exe

Filesize
184KB

MD5
eb37325e0d3c2fcad6562a7feabf389e

SHA1
c89e094ca8ca59b029a828ff18a621ace9529290

SHA256
ffa5792717306f1ee2708e9a5d1d2e1f060bb2e19962250ab21230ff0c929012

SHA512
3ccd8174860f13a49950f9749181c1b22f7b3e8ea56a569840e221eb20c1ccc7fbf97c571f0a62d78242f1a45ad1450a0f4867f256a1762ea240cab80973da5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31232.exe

Filesize
184KB

MD5
600aa3086d5b76da7989c8f81a485f63

SHA1
858376fa1adc5a02e4e46b97ba79ba0279d08dbd

SHA256
e6c64aa9474dd348adf203f25e79d71043fdeff81cd96888964e35fcab9838fe

SHA512
884550c0fab62eed80cfbcdfd02b5f7506d943b1bdd0450f0bd196e01908338ec958c85f884e97e4faaf12b2172249a01b4fce39e9b86b488e5f8a0748551425

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32475.exe

Filesize
184KB

MD5
0747fb76ae47ebc4f0858a4b5fd0fa19

SHA1
60f5d847a59c558b43864fedda43163b827369fa

SHA256
2cbb547647058aa1591aad360db012a341e580cf85f4193913dfbf9d13f5173b

SHA512
550f777cb4e257b11d5c93910d7e5a4ff199a750cfa5d3300557b1379de85d70f34a67f3c7806287fd7405986a529e60834fd757e06187aba69ecc1b68597457

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34267.exe

Filesize
184KB

MD5
8dc34714dd6b43e0df8c64bd2c3b0956

SHA1
4a45f3c5293209d4039c17508dfc98d3d0730c7c

SHA256
b67f86c67e9ed0b255d6dd93163916591dbd676c69f941c7365f8cdd7afc2065

SHA512
b13ba096f7b769d21da1672c9b712ebed878036ee59650e8f22f7f20ddcde05812a894ee2b36972c39409295627e3093990ecf0d7bb85dd3ad1fcfd48e8ccf21

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37098.exe

Filesize
184KB

MD5
baecd0dda309a154eb11d085116f3d34

SHA1
765cdd2adc38ab45059053cdd2f23b00252e4f19

SHA256
6b1f6f12f2260d32c866e113e1866f4e064f66d051d051875a9dc759a0f84359

SHA512
36da83f26f251f89021ca8d211dc7d8c2fba8d159669be1fc45fe33888de2ab130e83ef856156f32b1419b325d2c43d66ec42e5d415f5f19303fba57278a34c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39817.exe

Filesize
184KB

MD5
894d9d942561d4fa4c3bacb818327209

SHA1
5608fdc639733408aed9890c44d72ac0c6ddef5d

SHA256
26d7301b4dd8d3def41efa25ceb78a3d131d70e22b22fbc066ff6a5b30729503

SHA512
bd1ea110f5d23dec8e5995151a026ca704607963386ae6db8495be75a6f84757b8a9575a29369567153efc13c787d3d2bdc0a7aaef834828d1737b9537fa4b46

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40347.exe

Filesize
184KB

MD5
9de81d90af76d6fa81bad5aaffaabd5f

SHA1
8f91ac73fbb79732d76439237edb9f9ca489a010

SHA256
b28c068e766883d4865b1304eadccb065812b30f86d83e1bd5361fab0d91cec3

SHA512
c7c9a41c136abaae82e7ae623ac28fd32a695eff5bc7990596b147ee23db463b85742e04e95e80521a6c11036a621b7cd64fa772d06accce5a6b23fc1e832f79

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40512.exe

Filesize
184KB

MD5
e2d7bdfe21eb67a4016793d1b5384362

SHA1
616b4fa32bd8845087e06c144980122663919ebb

SHA256
e8fe6c7d47216b20221bef579a579660f575b3bc7f6ed32e575abbe08df4426a

SHA512
792e34f12ee4f5a5c98e4339eb041f8eb1be417c19958a5f748cb04726edeb9b2a5a0d7e8a77d7939da952934f72c5645c609466f028c8ca64aac2f44af308a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40539.exe

Filesize
184KB

MD5
ce66d3c6dc327eeeccd1d9cc319d0217

SHA1
8706894ab1bfc72e015fd5836b4fe675da187334

SHA256
9df9aee331133fd6badc4dcbdff641649e89e28da7442f65fe5a8468277cc73a

SHA512
1a0d92eb1e1dc6b057b51ddfa63f0b086dcc3199ba356070514764a73192b254455a1ff1e3ea426431b2dfb382e12dafa2ee8ab0a39a78919b23a9edf6352f75

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44026.exe

Filesize
184KB

MD5
307c7b9f50de57359442c43c0122bbf1

SHA1
3d272d51ac84c941cab8f26bdc9384bd47aab17c

SHA256
8db1398f39c56bc81512f177825c30949a4e2c98ac54ee7c22b91289edd54f79

SHA512
ca28dbf263909c9af08362c9fce0ee6916509192eda28348823f72924f4d4a43d55387779bacccb85cbfed31890dfd6bc54c9e07fc91617b2fcbecd50ae7ab2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45178.exe

Filesize
184KB

MD5
5e90b87e383c2df60a9c34ecfd52e851

SHA1
a056c4d44a5b2ca34a04f9da3d62a8aa463fe0ac

SHA256
2dfbf2f701280abf47cc2dbbfff62fa0876307fa022bca3f1a8e545b3fe253d1

SHA512
0819a3eb4073c3414870491238846a630ee93d95b0d006bef5f530c03e6f3881a0466742ad9fb39d619b5c14ebd241ad1a1825c2c7eebe42806f3c3a1e2653f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48722.exe

Filesize
184KB

MD5
25b8073012d38e2f0d8a95a1ba43d3e4

SHA1
7da7c12001f5207566313d6ad295a9f4c4c0d360

SHA256
91b3d01a3dbe6d42b2612613afda714fab7e85032195f7e3957454f86b5d9ad0

SHA512
567c7b9143e066785401e3ef02caf1670b5718e2dedacb42fc69cd9c22f008addfcfe0acf7829fd0a7c2dc8557ade558dd929c3cde92cc385ea60b0457a86065

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52251.exe

Filesize
184KB

MD5
9f5097cdde6f18306b905728863c6a94

SHA1
bd57dcefd1c626bcf3655cbadc57dc9f54c46b84

SHA256
3337058577d65b0ca17d7110c4296ef35a8d7f6923c50860212e05b1e7a0a4b5

SHA512
de6b551127b372f99fc41b9f6987ab0fb7834b61128ab33f968b849bda1686330bec75ed51531bec2fbc3113ee913f05efc742038153528274d321323273a6f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54571.exe

Filesize
184KB

MD5
5a39de585a2068fc2a491b1b3bd80c8d

SHA1
a69d43119e1513b27dbe0b51252ee7d73b9718f0

SHA256
e22f137847b3d345152c6f48f9ca6b8fed219df124dc4fd2d4e48b7ca8af88fe

SHA512
c1609d0cfe924eb04df67c6fe3e96488dba5d8d23f4f39c924544ef7cbdbcddd995af41fa6ff924489498b0c9fed212eef4a8bff4befb98ffd53e743edfaa6d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55043.exe

Filesize
184KB

MD5
8d6e8c0f8c9b728ba190b717f586b3c8

SHA1
3872249ae37f00e8c6143ac0b855f4f123865812

SHA256
f8e25cd75b58db08219f5a5f140eea1b31650499624ad3a31e4cea172b235f00

SHA512
dc014570bb5f1c17902b3432d9618c107e897571b05cd0a3c856cf7b348b1d5950b55b6396574e6aa7dba6ad9614a4e8e0433a1a6f6de70f77aed482db6569b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56018.exe

Filesize
184KB

MD5
7aea4dd7caae8c762c6736e89c3ef8e2

SHA1
801596bde00e9c14a7f10a5dfa24715990777700

SHA256
492209f6fbfc762a3a5266124a121ad9bf1375f7b8e25dd9bb75390628695ca1

SHA512
ab89f902b35bf01b006c7c2d917e806ac77923ee3348834223f1e6a897a0d464b9ee7a55c8c220e1194cc644114e9382b541487b7da14312e9c97403d9476b0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56305.exe

Filesize
184KB

MD5
b26e3a06c208c405d5537d8c8128ae1d

SHA1
246057986874a34d59f1130409eb0ffc888f0e93

SHA256
b131b3834ced78071429695355b7c9928418267fdd0e0e62fd60c4c08834c396

SHA512
ee285ce92802154357f22ccc307afe4abb5af321aaae3abbb2cada4d9b14c79049d06f7a66c955a8bdef458cbff97a4bd2c9db1daccf1e4652dbfc7541da11cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56875.exe

Filesize
184KB

MD5
5925418348ece937fc64fa0b4a6bb5a5

SHA1
65be241baed9e91264cc6240ccdc9e5447470bc8

SHA256
bab57f94c292b5d0d05e0a3dea7ae9f9e036664b83e7516974e4e31095837ae8

SHA512
134945f1c81b09975148bd29b91e4b6a493a77bb19ba8dd60120658eb2c398975c2e67a72ea16a31734edca6edb2d15818836b772527ce2726471ebc2d9f9928

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59547.exe

Filesize
184KB

MD5
c496e10a1d69c2ba86dc04e1a2f1f7e1

SHA1
57dc491caa110778ea50d329dc6ddd65f3fc1fd8

SHA256
ee7c52857367275e723ce385b427c4117aec1f26f6ad489928316fd97f6f6301

SHA512
e6c47f42e72526fe58c1dabd154ea8f2a7f5cfa094ef1c7d4294fcefe96b0ccf095240d7fb997d7eb6006fb3491d26f958532ad49bfbe203479471543ebf88f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6034.exe

Filesize
184KB

MD5
d2ac53d8c5eb2f38c4dc1eb66b1cdac5

SHA1
f0d3baf32cdcb3b1df6bf0dda9d298f9e13e15c5

SHA256
fd4c238cb8e8f5bf86b076ed6fd313cabff0b2a26bca435415703c715c1081e5

SHA512
2e7cd87782255f39907850ff9629429c8ff2e29a805deb4ed74eb65102ea51e801460e655bde892c7afa5050a3b4ee4440edd73a38c41ef1f421d774f569ffcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62016.exe

Filesize
184KB

MD5
d53441b04f61f3e2a51df798580fa06d

SHA1
e1decdee2fdcaab70a0c7bfaae394e2a413ec985

SHA256
fdb3fb362d530dc81566b4dd930fffcd58350af3538df042c5da60bca73fa297

SHA512
643590739205df5fc3405d74dcccbe24a9466c18b7778ababf24a5bc722357fb867ef78d2c329c529d085ca16a2cef29d6faad73edbaae537425aae7aa000a4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65235.exe

Filesize
184KB

MD5
d92ad632a4d6ae0083ef11ee9c203dcd

SHA1
23d47de0b9a03277afb92841f2c8c6dcc94657e8

SHA256
e57901fbcb93638ae196d3b82139cfa89e91257bc000c342b1b3ec7a4c74313e

SHA512
5068c25712433392e12a06f2e221d7b5f58ec4974839479f93930b8971f2c8ef0ba0c6ff50836e20e793a5594ca51d65ec78b19a8f6cee5c26aef079e2f7077b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7482.exe

Filesize
184KB

MD5
88b21a1d6283b7f58bfd1c9822f315d9

SHA1
9fe790d66722d36dc82410ffb889d2f505b06b40

SHA256
d7f3e1d7c54027a077e66d3c7594e44fa61217a0c226c21ae936472b4cfa2bfb

SHA512
e2d8a08d734ac0f599b493435ac540806da8350ff4688368cd2583389c1656d96df2089b987d7394827b386c5e68c9934ae0d308a6b45e3d3f54381c7089da53

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7674.exe

Filesize
184KB

MD5
5ea6cc51346665d3cf3030a8415297fc

SHA1
9022e6f5f86b5995345ef6098d1432a4f99ef17f

SHA256
a330eb8e1c60d9ffa37d089270ba247876512a78600e1ebcaedb7759c62649dd

SHA512
be865c6dd859920fad69c7e33dc967c83fbc2f553c9d007f1c249bb055391b5f12fa6780663f4882a0af990605a841cbc4fda5488e5d6ad23be4592642f04fa1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9786.exe

Filesize
184KB

MD5
d935a29edce005a6417ad92409df4662

SHA1
7d1f39ec128045e4d60acdd639134e4d5382f29e

SHA256
74b0c9af0682e8932fb6af1c8cd130caf368eea63638b796ee04784a99b1f8c4

SHA512
c0388a4f23153f7ef950a5e78f3338461187cd01625d81f12e025fd3749bbf20cdc1057cb2aa26ccce985da4999b53c81a34a4f8866978969103c0e9ff42ab49

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads