fa2cdd5f4c4f437e677c4c803639575e3ff47014221ab44679c3413749dfd313

Analysis

max time kernel
150s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 03:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa2cdd5f4c4f437e677c4c803639575e3ff47014221ab44679c3413749dfd313.exe
Size

468KB
MD5

20125be59096ef5547b81329bb6c3897
SHA1

609bac6d30a690d54fc02ac8dfe1b7cc00d55dea
SHA256

fa2cdd5f4c4f437e677c4c803639575e3ff47014221ab44679c3413749dfd313
SHA512

0cb03027d7501ea88963f2a99f371be738910fa527a64ea5ecbc6d9ef35feba9d2ecbc683782b13824e5e4a50e2313dbed01a276844529fd6417299cb69d8cbc
SSDEEP

3072:yu0oogkEIO5AtbY4zfjSff8w0COiP3QT/EHTYV/gDWMLLA6ceRl7:yuTot6AtHzrSfflAC/DWmU6ce

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4024	Unicorn-5271.exe
4028	Unicorn-41800.exe
4716	Unicorn-5022.exe
540	Unicorn-37384.exe
2848	Unicorn-50191.exe
3024	Unicorn-37576.exe
2148	Unicorn-15986.exe
5056	Unicorn-40472.exe
1944	Unicorn-20030.exe
2036	Unicorn-23752.exe
1776	Unicorn-36454.exe
1664	Unicorn-42584.exe
1092	Unicorn-58920.exe
3996	Unicorn-26175.exe
4628	Unicorn-6574.exe
4124	Unicorn-9146.exe
1100	Unicorn-54434.exe
3848	Unicorn-27979.exe
4876	Unicorn-34808.exe
1592	Unicorn-27211.exe
2076	Unicorn-43547.exe
1868	Unicorn-10298.exe
4576	Unicorn-29323.exe
724	Unicorn-23192.exe
3340	Unicorn-29058.exe
4304	Unicorn-25793.exe
3592	Unicorn-23192.exe
5040	Unicorn-9457.exe
4560	Unicorn-45659.exe
2700	Unicorn-9649.exe
4332	Unicorn-5690.exe
4400	Unicorn-21704.exe
2396	Unicorn-48498.exe
1824	Unicorn-55113.exe
212	Unicorn-44331.exe
452	Unicorn-11336.exe
232	Unicorn-56946.exe
2612	Unicorn-33506.exe
4948	Unicorn-20401.exe
1940	Unicorn-31451.exe
4032	Unicorn-60402.exe
1920	Unicorn-34274.exe
4892	Unicorn-698.exe
3468	Unicorn-60105.exe
4988	Unicorn-17035.exe
2128	Unicorn-32856.exe
2404	Unicorn-16328.exe
836	Unicorn-52338.exe
3988	Unicorn-16459.exe
4116	Unicorn-29679.exe
3100	Unicorn-35810.exe
1716	Unicorn-15809.exe
1576	Unicorn-9944.exe
5008	Unicorn-61746.exe
1604	Unicorn-23480.exe
1184	Unicorn-15809.exe
944	Unicorn-42027.exe
4348	Unicorn-54642.exe
5000	Unicorn-41643.exe
4256	Unicorn-2456.exe
340	Unicorn-24539.exe
4396	Unicorn-60091.exe
5112	Unicorn-56562.exe
3892	Unicorn-30169.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
3292	4576	WerFault.exe	109
5856	6012	WerFault.exe
6636	1652	WerFault.exe	172
16160	12176	WerFault.exe	676
15868	15188	WerFault.exe	752

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19279.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41800.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20030.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27560.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2392.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52569.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28271.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18376.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32731.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51113.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16641.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24680.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31451.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46770.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46144.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63065.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6984.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61712.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2504.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41403.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16399.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25433.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1537.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1441.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36185.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9496.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56843.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2047.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56770.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41961.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41713.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8437.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17927.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18433.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41209.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62985.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13079.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38945.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18369.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14785.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15361.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45659.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17035.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2113.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59721.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60386.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8577.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4081.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55577.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-161.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62210.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51473.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19547.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27480.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17236	dwm.exe
Token: SeChangeNotifyPrivilege	17236	dwm.exe
Token: 33	17236	dwm.exe
Token: SeIncBasePriorityPrivilege	17236	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
5076	fa2cdd5f4c4f437e677c4c803639575e3ff47014221ab44679c3413749dfd313.exe
4024	Unicorn-5271.exe
4028	Unicorn-41800.exe
4716	Unicorn-5022.exe
540	Unicorn-37384.exe
2848	Unicorn-50191.exe
3024	Unicorn-37576.exe
2148	Unicorn-15986.exe
5056	Unicorn-40472.exe
1944	Unicorn-20030.exe
1776	Unicorn-36454.exe
1664	Unicorn-42584.exe
3996	Unicorn-26175.exe
4628	Unicorn-6574.exe
2036	Unicorn-23752.exe
1092	Unicorn-58920.exe
4124	Unicorn-9146.exe
1100	Unicorn-54434.exe
3848	Unicorn-27979.exe
4876	Unicorn-34808.exe
1592	Unicorn-27211.exe
2076	Unicorn-43547.exe
2700	Unicorn-9649.exe
4560	Unicorn-45659.exe
4576	Unicorn-29323.exe
1868	Unicorn-10298.exe
3340	Unicorn-29058.exe
4304	Unicorn-25793.exe
5040	Unicorn-9457.exe
3592	Unicorn-23192.exe
724	Unicorn-23192.exe
4332	Unicorn-5690.exe
4400	Unicorn-21704.exe
2396	Unicorn-48498.exe
1824	Unicorn-55113.exe
212	Unicorn-44331.exe
452	Unicorn-11336.exe
232	Unicorn-56946.exe
2612	Unicorn-33506.exe
4948	Unicorn-20401.exe
1940	Unicorn-31451.exe
4032	Unicorn-60402.exe
1920	Unicorn-34274.exe
4988	Unicorn-17035.exe
3468	Unicorn-60105.exe
4892	Unicorn-698.exe
2128	Unicorn-32856.exe
2404	Unicorn-16328.exe
4116	Unicorn-29679.exe
836	Unicorn-52338.exe
3100	Unicorn-35810.exe
5008	Unicorn-61746.exe
1576	Unicorn-9944.exe
1716	Unicorn-15809.exe
3988	Unicorn-16459.exe
1184	Unicorn-15809.exe
1604	Unicorn-23480.exe
944	Unicorn-42027.exe
4348	Unicorn-54642.exe
4256	Unicorn-2456.exe
5000	Unicorn-41643.exe
5112	Unicorn-56562.exe
4396	Unicorn-60091.exe
340	Unicorn-24539.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 4024	5076	fa2cdd5f4c4f437e677c4c803639575e3ff47014221ab44679c3413749dfd313.exe	82
PID 5076 wrote to memory of 4024	5076	fa2cdd5f4c4f437e677c4c803639575e3ff47014221ab44679c3413749dfd313.exe	82
PID 5076 wrote to memory of 4024	5076	fa2cdd5f4c4f437e677c4c803639575e3ff47014221ab44679c3413749dfd313.exe	82
PID 4024 wrote to memory of 4028	4024	Unicorn-5271.exe	83
PID 4024 wrote to memory of 4028	4024	Unicorn-5271.exe	83
PID 4024 wrote to memory of 4028	4024	Unicorn-5271.exe	83
PID 5076 wrote to memory of 4716	5076	fa2cdd5f4c4f437e677c4c803639575e3ff47014221ab44679c3413749dfd313.exe	84
PID 5076 wrote to memory of 4716	5076	fa2cdd5f4c4f437e677c4c803639575e3ff47014221ab44679c3413749dfd313.exe	84
PID 5076 wrote to memory of 4716	5076	fa2cdd5f4c4f437e677c4c803639575e3ff47014221ab44679c3413749dfd313.exe	84
PID 4028 wrote to memory of 540	4028	Unicorn-41800.exe	85
PID 4028 wrote to memory of 540	4028	Unicorn-41800.exe	85
PID 4028 wrote to memory of 540	4028	Unicorn-41800.exe	85
PID 4024 wrote to memory of 2848	4024	Unicorn-5271.exe	86
PID 4024 wrote to memory of 2848	4024	Unicorn-5271.exe	86
PID 4024 wrote to memory of 2848	4024	Unicorn-5271.exe	86
PID 4716 wrote to memory of 3024	4716	Unicorn-5022.exe	87
PID 4716 wrote to memory of 3024	4716	Unicorn-5022.exe	87
PID 4716 wrote to memory of 3024	4716	Unicorn-5022.exe	87
PID 5076 wrote to memory of 2148	5076	fa2cdd5f4c4f437e677c4c803639575e3ff47014221ab44679c3413749dfd313.exe	88
PID 5076 wrote to memory of 2148	5076	fa2cdd5f4c4f437e677c4c803639575e3ff47014221ab44679c3413749dfd313.exe	88
PID 5076 wrote to memory of 2148	5076	fa2cdd5f4c4f437e677c4c803639575e3ff47014221ab44679c3413749dfd313.exe	88
PID 540 wrote to memory of 5056	540	Unicorn-37384.exe	93
PID 540 wrote to memory of 5056	540	Unicorn-37384.exe	93
PID 540 wrote to memory of 5056	540	Unicorn-37384.exe	93
PID 4028 wrote to memory of 1944	4028	Unicorn-41800.exe	94
PID 4028 wrote to memory of 1944	4028	Unicorn-41800.exe	94
PID 4028 wrote to memory of 1944	4028	Unicorn-41800.exe	94
PID 2848 wrote to memory of 2036	2848	Unicorn-50191.exe	95
PID 2848 wrote to memory of 2036	2848	Unicorn-50191.exe	95
PID 2848 wrote to memory of 2036	2848	Unicorn-50191.exe	95
PID 4024 wrote to memory of 1776	4024	Unicorn-5271.exe	96
PID 4024 wrote to memory of 1776	4024	Unicorn-5271.exe	96
PID 4024 wrote to memory of 1776	4024	Unicorn-5271.exe	96
PID 2148 wrote to memory of 1664	2148	Unicorn-15986.exe	97
PID 2148 wrote to memory of 1664	2148	Unicorn-15986.exe	97
PID 2148 wrote to memory of 1664	2148	Unicorn-15986.exe	97
PID 3024 wrote to memory of 1092	3024	Unicorn-37576.exe	98
PID 3024 wrote to memory of 1092	3024	Unicorn-37576.exe	98
PID 3024 wrote to memory of 1092	3024	Unicorn-37576.exe	98
PID 4716 wrote to memory of 4628	4716	Unicorn-5022.exe	99
PID 4716 wrote to memory of 4628	4716	Unicorn-5022.exe	99
PID 4716 wrote to memory of 4628	4716	Unicorn-5022.exe	99
PID 5076 wrote to memory of 3996	5076	fa2cdd5f4c4f437e677c4c803639575e3ff47014221ab44679c3413749dfd313.exe	100
PID 5076 wrote to memory of 3996	5076	fa2cdd5f4c4f437e677c4c803639575e3ff47014221ab44679c3413749dfd313.exe	100
PID 5076 wrote to memory of 3996	5076	fa2cdd5f4c4f437e677c4c803639575e3ff47014221ab44679c3413749dfd313.exe	100
PID 5056 wrote to memory of 4124	5056	Unicorn-40472.exe	102
PID 5056 wrote to memory of 4124	5056	Unicorn-40472.exe	102
PID 5056 wrote to memory of 4124	5056	Unicorn-40472.exe	102
PID 540 wrote to memory of 1100	540	Unicorn-37384.exe	103
PID 540 wrote to memory of 1100	540	Unicorn-37384.exe	103
PID 540 wrote to memory of 1100	540	Unicorn-37384.exe	103
PID 3996 wrote to memory of 3848	3996	Unicorn-26175.exe	104
PID 3996 wrote to memory of 3848	3996	Unicorn-26175.exe	104
PID 3996 wrote to memory of 3848	3996	Unicorn-26175.exe	104
PID 5076 wrote to memory of 4876	5076	fa2cdd5f4c4f437e677c4c803639575e3ff47014221ab44679c3413749dfd313.exe	105
PID 5076 wrote to memory of 4876	5076	fa2cdd5f4c4f437e677c4c803639575e3ff47014221ab44679c3413749dfd313.exe	105
PID 5076 wrote to memory of 4876	5076	fa2cdd5f4c4f437e677c4c803639575e3ff47014221ab44679c3413749dfd313.exe	105
PID 1664 wrote to memory of 1592	1664	Unicorn-42584.exe	106
PID 1664 wrote to memory of 1592	1664	Unicorn-42584.exe	106
PID 1664 wrote to memory of 1592	1664	Unicorn-42584.exe	106
PID 4628 wrote to memory of 2076	4628	Unicorn-6574.exe	107
PID 4628 wrote to memory of 2076	4628	Unicorn-6574.exe	107
PID 4628 wrote to memory of 2076	4628	Unicorn-6574.exe	107
PID 1776 wrote to memory of 1868	1776	Unicorn-36454.exe	108

C:\Users\Admin\AppData\Local\Temp\fa2cdd5f4c4f437e677c4c803639575e3ff47014221ab44679c3413749dfd313.exe
"C:\Users\Admin\AppData\Local\Temp\fa2cdd5f4c4f437e677c4c803639575e3ff47014221ab44679c3413749dfd313.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5271.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5271.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41800.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41800.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37384.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40472.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9146.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5690.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42027.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25899.exe
        9⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62731.exe
        10⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52466.exe
        11⤵
        
        PID:13104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5832.exe
        11⤵
        
        PID:17212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23778.exe
        11⤵
        
        PID:15496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51401.exe
        10⤵
        
        PID:10660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4408.exe
        10⤵
        
        PID:13968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2625.exe
        10⤵
        
        PID:18368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34463.exe
        10⤵
        
        PID:15484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59721.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33880.exe
        9⤵
        
        PID:10964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31042.exe
        9⤵
        
        PID:15108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41009.exe
        8⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52658.exe
        9⤵
        
        PID:7296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32731.exe
        10⤵
        
        PID:13036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4929.exe
        10⤵
        
        PID:17328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11800.exe
        10⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11297.exe
        9⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41209.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51330.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:15608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48713.exe
        8⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31977.exe
        8⤵
        
        PID:10256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1608.exe
        8⤵
        
        PID:13960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3665.exe
        8⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54642.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60683.exe
        8⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43250.exe
        9⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52651.exe
        10⤵
        
        PID:16216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31688.exe
        9⤵
        
        PID:7528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29403.exe
        10⤵
        
        PID:16240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28271.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:12852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41961.exe
        9⤵
        
        PID:17136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17297.exe
        8⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37705.exe
        8⤵
        
        PID:8412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62297.exe
        8⤵
        
        PID:14100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58943.exe
        8⤵
        
        PID:9768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
        7⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11978.exe
        8⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37195.exe
        9⤵
        
        PID:8488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-161.exe
        9⤵
        
        PID:11912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45312.exe
        9⤵
        
        PID:15088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30593.exe
        8⤵
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30575.exe
        8⤵
        
        PID:12980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25433.exe
        8⤵
        
        PID:16544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1208.exe
        8⤵
        
        PID:15472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16088.exe
        7⤵
        
        PID:8012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65522.exe
        8⤵
        
        PID:11596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38945.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22079.exe
        8⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13327.exe
        7⤵
        
        PID:10556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50610.exe
        7⤵
        
        PID:13864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60800.exe
        7⤵
        
        PID:15720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21704.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41643.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60683.exe
        8⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44402.exe
        9⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65522.exe
        10⤵
        
        PID:11536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38945.exe
        10⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31688.exe
        9⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28271.exe
        9⤵
        
        PID:12776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41961.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:17152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21464.exe
        8⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50786.exe
        9⤵
        
        PID:8464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63026.exe
        9⤵
        
        PID:12904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36096.exe
        9⤵
        
        PID:17084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24972.exe
        9⤵
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8431.exe
        8⤵
        
        PID:9240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62297.exe
        8⤵
        
        PID:14108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59497.exe
        8⤵
        
        PID:18228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1592.exe
        8⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33329.exe
        7⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4138.exe
        8⤵
        
        PID:8536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40066.exe
        8⤵
        
        PID:13420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4920.exe
        8⤵
        
        PID:17628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33707.exe
        8⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20680.exe
        7⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54873.exe
        7⤵
        
        PID:11748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44489.exe
        7⤵
        
        PID:15920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36568.exe
        7⤵
        
        PID:15616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2456.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60683.exe
        7⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47858.exe
        8⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50930.exe
        9⤵
        
        PID:12712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6984.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:16972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9688.exe
        8⤵
        
        PID:9792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54098.exe
        8⤵
        
        PID:14516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19080.exe
        8⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42289.exe
        7⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58635.exe
        8⤵
        
        PID:9904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64569.exe
        8⤵
        
        PID:14552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34079.exe
        8⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45785.exe
        7⤵
        
        PID:10608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10273.exe
        7⤵
        
        PID:13912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45618.exe
        6⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18523.exe
        7⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54626.exe
        8⤵
        
        PID:9248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2047.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59234.exe
        8⤵
        
        PID:17456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35807.exe
        8⤵
        
        PID:17452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55490.exe
        7⤵
        
        PID:9932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12376.exe
        7⤵
        
        PID:11412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40482.exe
        7⤵
        
        PID:16608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60185.exe
        7⤵
        
        PID:17752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6520.exe
        6⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45739.exe
        7⤵
        
        PID:15764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45800.exe
        6⤵
        
        PID:10668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34811.exe
        6⤵
        
        PID:14024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54434.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48498.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24539.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45883.exe
        8⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7898.exe
        9⤵
        
        PID:9648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        9⤵
        
        PID:13248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2520.exe
        9⤵
        
        PID:17404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40917.exe
        9⤵
        
        PID:17816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16545.exe
        8⤵
        
        PID:7536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29656.exe
        8⤵
        
        PID:12016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51177.exe
        8⤵
        
        PID:15176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39072.exe
        8⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1809.exe
        7⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30251.exe
        8⤵
        
        PID:7764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30513.exe
        8⤵
        
        PID:10432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4408.exe
        8⤵
        
        PID:13952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2625.exe
        8⤵
        
        PID:18316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21048.exe
        7⤵
        
        PID:7736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39746.exe
        7⤵
        
        PID:10676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22376.exe
        7⤵
        
        PID:15092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57830.exe
        7⤵
        
        PID:11236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56562.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60107.exe
        7⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60386.exe
        8⤵
        
        PID:9152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18433.exe
        8⤵
        
        PID:11720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6744.exe
        8⤵
        
        PID:16344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42937.exe
        8⤵
        
        PID:17912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48258.exe
        7⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18504.exe
        7⤵
        
        PID:11008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52697.exe
        7⤵
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32792.exe
        7⤵
        
        PID:17224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62441.exe
        6⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8730.exe
        7⤵
        
        PID:7968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20145.exe
        7⤵
        
        PID:10296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61056.exe
        7⤵
        
        PID:15140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47737.exe
        7⤵
        
        PID:6648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26162.exe
        6⤵
        
        PID:5032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49913.exe
        6⤵
        
        PID:11280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39473.exe
        6⤵
        
        PID:14676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22881.exe
        6⤵
        
        PID:6672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55113.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60091.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45883.exe
        7⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30251.exe
        8⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10154.exe
        9⤵
        
        PID:14004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48562.exe
        9⤵
        
        PID:18204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37264.exe
        9⤵
        
        PID:16656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30513.exe
        8⤵
        
        PID:10440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4408.exe
        8⤵
        
        PID:13976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50800.exe
        8⤵
        
        PID:15188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7313.exe
        7⤵
        
        PID:7972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53035.exe
        8⤵
        
        PID:16096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26216.exe
        8⤵
        
        PID:7656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55152.exe
        7⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16433.exe
        7⤵
        
        PID:15272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16264.exe
        7⤵
        
        PID:5884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3672.exe
        6⤵
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7537.exe
        7⤵
        
        PID:8448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36424.exe
        7⤵
        
        PID:11884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45312.exe
        7⤵
        
        PID:15024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43129.exe
        7⤵
        
        PID:1864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23474.exe
        6⤵
        
        PID:8848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2875.exe
        7⤵
        
        PID:9132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22632.exe
        6⤵
        
        PID:11520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60818.exe
        6⤵
        
        PID:15856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30169.exe
        5⤵
        Executes dropped EXE
        
        PID:3892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32754.exe
        6⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41403.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54203.exe
        8⤵
        
        PID:16804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9496.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34561.exe
        7⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56889.exe
        7⤵
        
        PID:14932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48258.exe
        6⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31563.exe
        7⤵
        
        PID:11504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26200.exe
        7⤵
        
        PID:16372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19064.exe
        7⤵
        
        PID:17388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe
        6⤵
        
        PID:11228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33346.exe
        6⤵
        
        PID:15192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8828.exe
        6⤵
        
        PID:9504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65152.exe
        5⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7537.exe
        6⤵
        
        PID:8476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-161.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35769.exe
        6⤵
        
        PID:15780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44281.exe
        6⤵
        
        PID:6336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51122.exe
        5⤵
        
        PID:8208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26331.exe
        6⤵
        
        PID:16348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21857.exe
        6⤵
        
        PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41803.exe
        5⤵
        
        PID:11584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13872.exe
        5⤵
        
        PID:1932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20030.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11336.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10122.exe
        6⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28587.exe
        7⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6012 -s 464
        8⤵
        Program crash
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48258.exe
        7⤵
        
        PID:8188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18504.exe
        7⤵
        
        PID:10836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16433.exe
        7⤵
        
        PID:15284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11041.exe
        6⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53515.exe
        7⤵
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47250.exe
        7⤵
        
        PID:11496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57216.exe
        7⤵
        
        PID:1176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59465.exe
        7⤵
        
        PID:3328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30296.exe
        6⤵
        
        PID:8632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29378.exe
        6⤵
        
        PID:12056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19128.exe
        6⤵
        
        PID:16052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5816.exe
        6⤵
        
        PID:6856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20136.exe
        5⤵
        
        PID:4764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31291.exe
        6⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54626.exe
        7⤵
        
        PID:9224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12865.exe
        7⤵
        
        PID:13092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19567.exe
        7⤵
        
        PID:16256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25650.exe
        7⤵
        
        PID:11196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34625.exe
        6⤵
        
        PID:8768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63330.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12176
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12176 -s 464
        8⤵
        Program crash
        
        PID:16160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48562.exe
        7⤵
        
        PID:18292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37264.exe
        7⤵
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42201.exe
        6⤵
        
        PID:12296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22008.exe
        6⤵
        
        PID:15828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27858.exe
        5⤵
        
        PID:7024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4081.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63410.exe
        6⤵
        
        PID:12840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36096.exe
        6⤵
        
        PID:17128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21967.exe
        6⤵
        
        PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63929.exe
        5⤵
        
        PID:9772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9185.exe
        5⤵
        
        PID:13272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22362.exe
        5⤵
        
        PID:968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58480.exe
        5⤵
        
        PID:592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23192.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52338.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23906.exe
        6⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1498.exe
        7⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11105.exe
        8⤵
        
        PID:9576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63026.exe
        8⤵
        
        PID:12892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2712.exe
        8⤵
        
        PID:17244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31688.exe
        7⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11224.exe
        7⤵
        
        PID:12928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8577.exe
        7⤵
        
        PID:16444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19656.exe
        7⤵
        
        PID:3492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64578.exe
        6⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7306.exe
        7⤵
        
        PID:16912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24680.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38194.exe
        6⤵
        
        PID:10096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exe
        6⤵
        
        PID:15260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51330.exe
        6⤵
        
        PID:17800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39473.exe
        5⤵
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17835.exe
        6⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28219.exe
        7⤵
        
        PID:13900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37264.exe
        7⤵
        
        PID:3928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11569.exe
        6⤵
        
        PID:2100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26984.exe
        6⤵
        
        PID:13028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25433.exe
        6⤵
        
        PID:17260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57983.exe
        6⤵
        
        PID:15852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12776.exe
        5⤵
        
        PID:6876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16395.exe
        6⤵
        
        PID:10792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14296.exe
        6⤵
        
        PID:16924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26409.exe
        6⤵
        
        PID:15552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11992.exe
        5⤵
        
        PID:10172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9576.exe
        5⤵
        
        PID:11768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19064.exe
        5⤵
        
        PID:17384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13079.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15809.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20123.exe
        5⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1498.exe
        6⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32731.exe
        7⤵
        
        PID:13080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5832.exe
        7⤵
        
        PID:17192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38608.exe
        7⤵
        
        PID:18056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31688.exe
        6⤵
        
        PID:8388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28271.exe
        6⤵
        
        PID:12760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41961.exe
        6⤵
        
        PID:17144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63008.exe
        6⤵
        
        PID:16964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25503.exe
        6⤵
        
        PID:11244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9704.exe
        5⤵
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9361.exe
        6⤵
        
        PID:1808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35977.exe
        6⤵
        
        PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25065.exe
        5⤵
        
        PID:10148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exe
        5⤵
        
        PID:15252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34994.exe
        5⤵
        
        PID:1748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-632.exe
      4⤵
      PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52658.exe
        5⤵
        
        PID:7288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe
        6⤵
        
        PID:14572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42360.exe
        6⤵
        
        PID:15544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5032.exe
        5⤵
        
        PID:9356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62297.exe
        5⤵
        
        PID:14080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59497.exe
        5⤵
        
        PID:18244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17928.exe
        5⤵
        
        PID:16736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45713.exe
      4⤵
      PID:7364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64482.exe
        5⤵
        
        PID:13844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20927.exe
        5⤵
        
        PID:16836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23841.exe
      4⤵
      PID:10248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46144.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46809.exe
      4⤵
      PID:18112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13672.exe
      4⤵
      PID:2260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50191.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50191.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23752.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29323.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4576
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 724
        6⤵
        Program crash
        
        PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31231.exe
        5⤵
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47627.exe
        6⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51787.exe
        7⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4769.exe
        7⤵
        
        PID:10548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10568.exe
        7⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60809.exe
        7⤵
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35912.exe
        6⤵
        
        PID:8640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56704.exe
        6⤵
        
        PID:11972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26642.exe
        6⤵
        
        PID:16244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11521.exe
        5⤵
        
        PID:7032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40763.exe
        6⤵
        
        PID:9560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32984.exe
        6⤵
        
        PID:516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56729.exe
        6⤵
        
        PID:17476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30481.exe
        5⤵
        
        PID:10908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58843.exe
        5⤵
        
        PID:14204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25808.exe
        5⤵
        
        PID:5732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25793.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-698.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35883.exe
        6⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10088.exe
        7⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15000.exe
        8⤵
        
        PID:18100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55874.exe
        7⤵
        
        PID:11000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exe
        7⤵
        
        PID:15308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27992.exe
        6⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46363.exe
        7⤵
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36568.exe
        7⤵
        
        PID:16136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58400.exe
        7⤵
        
        PID:7592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54914.exe
        6⤵
        
        PID:11188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exe
        6⤵
        
        PID:15300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33831.exe
        6⤵
        
        PID:4316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2504.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33979.exe
        6⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32731.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4929.exe
        7⤵
        
        PID:17312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23778.exe
        7⤵
        
        PID:16688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48601.exe
        6⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5002.exe
        7⤵
        
        PID:16820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1816.exe
        7⤵
        
        PID:7248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12952.exe
        6⤵
        
        PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41728.exe
        5⤵
        
        PID:7148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12842.exe
        6⤵
        
        PID:13296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47602.exe
        6⤵
        
        PID:18280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20927.exe
        6⤵
        
        PID:16640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46249.exe
        5⤵
        
        PID:11148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8298.exe
        5⤵
        
        PID:15224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12176.exe
        5⤵
        
        PID:3516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29679.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20891.exe
        5⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12170.exe
        6⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30395.exe
        7⤵
        
        PID:11156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31809.exe
        7⤵
        
        PID:14436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24972.exe
        7⤵
        
        PID:1168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-616.exe
        6⤵
        
        PID:11048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49963.exe
        7⤵
        
        PID:14432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39864.exe
        7⤵
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7768.exe
        6⤵
        
        PID:15352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51753.exe
        6⤵
        
        PID:17792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26145.exe
        5⤵
        
        PID:7912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63714.exe
        6⤵
        
        PID:13788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62210.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65520.exe
        5⤵
        
        PID:10520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45634.exe
        5⤵
        
        PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58537.exe
        5⤵
        
        PID:18264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17928.exe
        5⤵
        
        PID:16624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59074.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59074.exe
      4⤵
      PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7754.exe
        5⤵
        
        PID:6436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4314.exe
        6⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23835.exe
        7⤵
        
        PID:17120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52073.exe
        7⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17109.exe
        7⤵
        
        PID:116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30529.exe
        6⤵
        
        PID:11604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37673.exe
        6⤵
        
        PID:14388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39922.exe
        6⤵
        
        PID:6292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34625.exe
        5⤵
        
        PID:8776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39408.exe
        5⤵
        
        PID:12068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36185.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36767.exe
        5⤵
        
        PID:15568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31631.exe
      4⤵
      PID:7184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18369.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54162.exe
      4⤵
      PID:14240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38496.exe
      4⤵
      PID:18308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9856.exe
      4⤵
      PID:1328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36454.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36454.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10298.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35810.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20123.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44843.exe
        7⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52994.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45241.exe
        7⤵
        
        PID:12308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30498.exe
        7⤵
        
        PID:16996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51952.exe
        7⤵
        
        PID:16008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9617.exe
        6⤵
        
        PID:7940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16127.exe
        6⤵
        
        PID:10580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10273.exe
        6⤵
        
        PID:13984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7608.exe
        6⤵
        
        PID:18092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39281.exe
        5⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51851.exe
        6⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9626.exe
        7⤵
        
        PID:10020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64178.exe
        7⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38400.exe
        7⤵
        
        PID:17368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52528.exe
        7⤵
        
        PID:5996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56153.exe
        6⤵
        
        PID:9788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9802.exe
        7⤵
        
        PID:15728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41208.exe
        7⤵
        
        PID:15952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10273.exe
        6⤵
        
        PID:13936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1592.exe
        6⤵
        
        PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63129.exe
        5⤵
        
        PID:6424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60386.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18433.exe
        6⤵
        
        PID:12368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63065.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25740.exe
        6⤵
        
        PID:10364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57986.exe
        5⤵
        
        PID:10068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48313.exe
        5⤵
        
        PID:13364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54306.exe
        5⤵
        
        PID:17824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23265.exe
        5⤵
        
        PID:18240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61746.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52795.exe
        5⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26722.exe
        6⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42299.exe
        7⤵
        
        PID:9860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29400.exe
        7⤵
        
        PID:14408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20431.exe
        7⤵
        
        PID:15592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31688.exe
        6⤵
        
        PID:6960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28271.exe
        6⤵
        
        PID:12752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8577.exe
        6⤵
        
        PID:17172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52144.exe
        6⤵
        
        PID:16116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1537.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37705.exe
        5⤵
        
        PID:9196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62297.exe
        5⤵
        
        PID:14088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26440.exe
        5⤵
        
        PID:18192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24197.exe
        5⤵
        
        PID:1976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53209.exe
      4⤵
      PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23899.exe
        5⤵
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29554.exe
        6⤵
        
        PID:9816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29400.exe
        6⤵
        
        PID:14416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31688.exe
        5⤵
        
        PID:8060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28271.exe
        5⤵
        
        PID:12768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8577.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54832.exe
        5⤵
        
        PID:5948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5185.exe
      4⤵
      PID:6920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32731.exe
        5⤵
        
        PID:13164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55033.exe
        5⤵
        
        PID:16560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57453.exe
        5⤵
        
        PID:10204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34904.exe
      4⤵
      PID:9232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37096.exe
      4⤵
      PID:14232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60027.exe
      4⤵
      PID:18400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13271.exe
      4⤵
      PID:15692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29058.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29058.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16459.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23906.exe
        5⤵
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10058.exe
        6⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32731.exe
        7⤵
        
        PID:13180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55033.exe
        7⤵
        
        PID:17296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-463.exe
        7⤵
        
        PID:17592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44914.exe
        7⤵
        
        PID:6728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31688.exe
        6⤵
        
        PID:8368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36336.exe
        6⤵
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30674.exe
        6⤵
        
        PID:16048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12751.exe
        6⤵
        
        PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2113.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55577.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10273.exe
        5⤵
        
        PID:13920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1208.exe
        5⤵
        
        PID:15528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39473.exe
      4⤵
      PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28699.exe
        5⤵
        
        PID:6968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53858.exe
        6⤵
        
        PID:9344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2047.exe
        6⤵
        
        PID:14656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50800.exe
        6⤵
        
        PID:17968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-616.exe
        5⤵
        
        PID:10952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1441.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64114.exe
        5⤵
        
        PID:2960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10223.exe
      4⤵
      PID:8000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21992.exe
      4⤵
      PID:10572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1608.exe
      4⤵
      PID:14012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42961.exe
      4⤵
      PID:18388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18657.exe
      4⤵
      PID:17392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23480.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23480.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20123.exe
      4⤵
      PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7754.exe
        5⤵
        
        PID:6552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5233.exe
        6⤵
        
        PID:9268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18376.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56729.exe
        6⤵
        
        PID:17468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8437.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31688.exe
        5⤵
        
        PID:4104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11224.exe
        5⤵
        
        PID:12952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25433.exe
        5⤵
        
        PID:17204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42186.exe
        5⤵
        
        PID:2088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50354.exe
      4⤵
      PID:7204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5935.exe
        5⤵
        
        PID:5588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37705.exe
      4⤵
      PID:10304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10273.exe
      4⤵
      PID:11632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59497.exe
      4⤵
      PID:18344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17928.exe
      4⤵
      PID:16828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33873.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33873.exe
    3⤵
    PID:5492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2186.exe
      4⤵
      PID:7052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57545.exe
      4⤵
      PID:8544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51113.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13969.exe
      4⤵
      PID:4812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63008.exe
      4⤵
      PID:17992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2801.exe
      4⤵
      PID:64
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53755.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53755.exe
    3⤵
    PID:8052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53019.exe
      4⤵
      PID:13256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39633.exe
      4⤵
      PID:17416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57632.exe
      4⤵
      PID:3196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21984.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21984.exe
    3⤵
    PID:10620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26201.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26201.exe
    3⤵
    PID:10428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45096.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45096.exe
    3⤵
    PID:16412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51473.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51473.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:17632
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5022.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5022.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37576.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37576.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58920.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45659.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17035.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19547.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1306.exe
        8⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3738.exe
        9⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53337.exe
        9⤵
        
        PID:11836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21928.exe
        9⤵
        
        PID:15988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44521.exe
        8⤵
        
        PID:9296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52201.exe
        8⤵
        
        PID:11932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53929.exe
        8⤵
        
        PID:17492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53058.exe
        8⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48050.exe
        7⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60386.exe
        8⤵
        
        PID:9136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18433.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4632.exe
        8⤵
        
        PID:16328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24972.exe
        8⤵
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54914.exe
        7⤵
        
        PID:11160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
        8⤵
        
        PID:15772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1816.exe
        8⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exe
        7⤵
        
        PID:15332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34994.exe
        7⤵
        
        PID:16508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-879.exe
        6⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13665.exe
        7⤵
        
        PID:8020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51867.exe
        8⤵
        
        PID:14668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
        8⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20145.exe
        7⤵
        
        PID:10640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61056.exe
        7⤵
        
        PID:15008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64073.exe
        7⤵
        
        PID:6664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26546.exe
        6⤵
        
        PID:6588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
        6⤵
        
        PID:11796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43713.exe
        6⤵
        
        PID:16148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16328.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38514.exe
        6⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-538.exe
        7⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-609.exe
        8⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17281.exe
        8⤵
        
        PID:11788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17647.exe
        8⤵
        
        PID:16548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41842.exe
        8⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48601.exe
        7⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62153.exe
        7⤵
        
        PID:12356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62594.exe
        7⤵
        
        PID:17760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55600.exe
        7⤵
        
        PID:6804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11464.exe
        6⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49451.exe
        7⤵
        
        PID:11660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42993.exe
        7⤵
        
        PID:17564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26409.exe
        7⤵
        
        PID:15628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3688.exe
        6⤵
        
        PID:10004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45433.exe
        6⤵
        
        PID:14492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47048.exe
        6⤵
        
        PID:18056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33323.exe
        6⤵
        
        PID:18416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21793.exe
        5⤵
        
        PID:5228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46395.exe
        6⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17595.exe
        7⤵
        
        PID:8472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38754.exe
        8⤵
        
        PID:15908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60829.exe
        8⤵
        
        PID:9352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15553.exe
        7⤵
        
        PID:12352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56729.exe
        7⤵
        
        PID:17448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15137.exe
        6⤵
        
        PID:10328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4408.exe
        6⤵
        
        PID:13892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2625.exe
        6⤵
        
        PID:18376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5119.exe
        5⤵
        
        PID:7920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15089.exe
        6⤵
        
        PID:14136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6712.exe
        6⤵
        
        PID:1080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14545.exe
        5⤵
        
        PID:10828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58786.exe
        5⤵
        
        PID:14984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9649.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34274.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1866.exe
        6⤵
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10280.exe
        7⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13025.exe
        8⤵
        
        PID:9840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48233.exe
        8⤵
        
        PID:14528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17743.exe
        8⤵
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37042.exe
        7⤵
        
        PID:10720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12065.exe
        8⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59465.exe
        7⤵
        
        PID:10820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49025.exe
        7⤵
        
        PID:16652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34610.exe
        7⤵
        
        PID:17584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17624.exe
        6⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23835.exe
        7⤵
        
        PID:17020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44473.exe
        7⤵
        
        PID:6744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52121.exe
        6⤵
        
        PID:9388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62297.exe
        6⤵
        
        PID:13244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58537.exe
        6⤵
        
        PID:18256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63298.exe
        5⤵
        
        PID:1652
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 636
        6⤵
        Program crash
        
        PID:6636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41728.exe
        5⤵
        
        PID:7140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46731.exe
        6⤵
        
        PID:10924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15473.exe
        6⤵
        
        PID:14540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62585.exe
        5⤵
        
        PID:11180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41777.exe
        5⤵
        
        PID:14168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34514.exe
        5⤵
        
        PID:17240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60105.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35883.exe
        5⤵
        
        PID:1584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43634.exe
        6⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17595.exe
        7⤵
        
        PID:8916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32600.exe
        7⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28031.exe
        7⤵
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3313.exe
        7⤵
        
        PID:16628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31688.exe
        6⤵
        
        PID:7112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28271.exe
        6⤵
        
        PID:12740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8577.exe
        6⤵
        
        PID:8972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20815.exe
        6⤵
        
        PID:17252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20696.exe
        5⤵
        
        PID:7176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4465.exe
        6⤵
        
        PID:8664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48418.exe
        6⤵
        
        PID:12648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56729.exe
        6⤵
        
        PID:17504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36191.exe
        6⤵
        
        PID:5820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37705.exe
        5⤵
        
        PID:8844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62297.exe
        5⤵
        
        PID:14220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34264.exe
        5⤵
        
        PID:15576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38249.exe
      4⤵
      PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10280.exe
        5⤵
        
        PID:5500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6673.exe
        5⤵
        
        PID:11020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exe
        5⤵
        
        PID:15340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18657.exe
        5⤵
        
        PID:16164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38928.exe
      4⤵
      PID:7084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40763.exe
        5⤵
        
        PID:9444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13057.exe
        5⤵
        
        PID:11868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28031.exe
        5⤵
        
        PID:16956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49889.exe
      4⤵
      PID:9948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48843.exe
      4⤵
      PID:13352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49840.exe
      4⤵
      PID:1588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64217.exe
      4⤵
      PID:5592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6574.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6574.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43547.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31009.exe
        5⤵
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50123.exe
        6⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50786.exe
        7⤵
        
        PID:9092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63026.exe
        7⤵
        
        PID:12916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36096.exe
        7⤵
        
        PID:17160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61193.exe
        7⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56153.exe
        6⤵
        
        PID:9608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10273.exe
        6⤵
        
        PID:13944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42585.exe
        6⤵
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35608.exe
        6⤵
        
        PID:18052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60825.exe
        5⤵
        
        PID:6700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57986.exe
        5⤵
        
        PID:10056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48313.exe
        5⤵
        
        PID:3404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe
        5⤵
        
        PID:17616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36722.exe
        5⤵
        
        PID:6140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32856.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38514.exe
        5⤵
        
        PID:5152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13679.exe
        6⤵
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22818.exe
        6⤵
        
        PID:10944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exe
        6⤵
        
        PID:15240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19482.exe
        6⤵
        
        PID:16956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64194.exe
        5⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14961.exe
        6⤵
        
        PID:10424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31809.exe
        6⤵
        
        PID:14504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44857.exe
        6⤵
        
        PID:5876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54914.exe
        5⤵
        
        PID:11172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58313.exe
        5⤵
        
        PID:14332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1112.exe
        5⤵
        
        PID:3716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3281.exe
        5⤵
        
        PID:5124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31288.exe
      4⤵
      PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56843.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52955.exe
        6⤵
        
        PID:8572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36040.exe
        6⤵
        
        PID:11952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45312.exe
        6⤵
        
        PID:15076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60617.exe
        6⤵
        
        PID:17688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16561.exe
        5⤵
        
        PID:8616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27618.exe
        6⤵
        
        PID:4568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58208.exe
        6⤵
        
        PID:6788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23128.exe
        5⤵
        
        PID:11640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12801.exe
        5⤵
        
        PID:16264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24978.exe
      4⤵
      PID:6676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42939.exe
        5⤵
        
        PID:7820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20145.exe
        5⤵
        
        PID:10984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25176.exe
        5⤵
        
        PID:15116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51321.exe
      4⤵
      PID:5168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6481.exe
      4⤵
      PID:11392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54946.exe
      4⤵
      PID:1448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47287.exe
      4⤵
      PID:15728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23192.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23192.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46770.exe
      4⤵
      PID:956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41713.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9583.exe
        5⤵
        
        PID:10288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10273.exe
        5⤵
        
        PID:13928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1592.exe
        5⤵
        
        PID:220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15569.exe
      4⤵
      PID:6936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24162.exe
        5⤵
        
        PID:17040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9880.exe
        5⤵
        
        PID:6072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16399.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8298.exe
      4⤵
      PID:15292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13463.exe
      4⤵
      PID:2724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15809.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15809.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20891.exe
      4⤵
      PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63618.exe
        5⤵
        
        PID:1904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32731.exe
        6⤵
        
        PID:13020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5832.exe
        6⤵
        
        PID:17352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20927.exe
        6⤵
        
        PID:1916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52121.exe
        5⤵
        
        PID:10048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10273.exe
        5⤵
        
        PID:13828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17928.exe
        5⤵
        
        PID:628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9320.exe
      4⤵
      PID:8100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5464.exe
      4⤵
      PID:10652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1608.exe
      4⤵
      PID:13992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34994.exe
      4⤵
      PID:2288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50409.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50409.exe
    3⤵
    PID:5460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8522.exe
      4⤵
      PID:6380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50786.exe
        5⤵
        
        PID:8512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40571.exe
        6⤵
        
        PID:5180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63026.exe
        5⤵
        
        PID:12936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36096.exe
        5⤵
        
        PID:17104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57379.exe
        5⤵
        
        PID:16180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31688.exe
      4⤵
      PID:8272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36336.exe
      4⤵
      PID:1060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30674.exe
      4⤵
      PID:15900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29087.exe
      4⤵
      PID:7584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45521.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45521.exe
    3⤵
    PID:6928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44747.exe
      4⤵
      PID:14032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53600.exe
      4⤵
      PID:4460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35435.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35435.exe
    3⤵
    PID:9308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32631.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32631.exe
    3⤵
    PID:14172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-600.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-600.exe
    3⤵
    PID:6284
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15986.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15986.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42584.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42584.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27211.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31451.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64907.exe
        6⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54539.exe
        7⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7537.exe
        8⤵
        
        PID:8516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-161.exe
        8⤵
        
        PID:11904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45312.exe
        8⤵
        
        PID:15188
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15188 -s 436
        9⤵
        Program crash
        
        PID:15868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26409.exe
        8⤵
        
        PID:15504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55186.exe
        7⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52283.exe
        8⤵
        
        PID:16664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41208.exe
        8⤵
        
        PID:7660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49008.exe
        7⤵
        
        PID:11736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50850.exe
        7⤵
        
        PID:15716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2751.exe
        7⤵
        
        PID:3820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43906.exe
        6⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-609.exe
        7⤵
        
        PID:8420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9393.exe
        7⤵
        
        PID:12620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17320.exe
        7⤵
        
        PID:16988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57453.exe
        7⤵
        
        PID:17776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16072.exe
        6⤵
        
        PID:8680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42066.exe
        6⤵
        
        PID:12044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3695.exe
        6⤵
        
        PID:15824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45234.exe
        5⤵
        
        PID:4516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46706.exe
        6⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44235.exe
        7⤵
        
        PID:10516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31809.exe
        7⤵
        
        PID:14352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41458.exe
        7⤵
        
        PID:17368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52121.exe
        6⤵
        
        PID:10076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18241.exe
        6⤵
        
        PID:11508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
        6⤵
        
        PID:16516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35416.exe
        6⤵
        
        PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25199.exe
        5⤵
        
        PID:2792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60747.exe
        6⤵
        
        PID:8804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42696.exe
        6⤵
        
        PID:14140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34601.exe
        6⤵
        
        PID:18148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8828.exe
        6⤵
        
        PID:15808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9553.exe
        5⤵
        
        PID:9988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10065.exe
        5⤵
        
        PID:14376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53364.exe
        5⤵
        
        PID:17076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60402.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
        5⤵
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17451.exe
        6⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8282.exe
        7⤵
        
        PID:9392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31074.exe
        8⤵
        
        PID:16224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11628.exe
        8⤵
        
        PID:9812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16072.exe
        7⤵
        
        PID:13148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3231.exe
        7⤵
        
        PID:17224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19279.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48601.exe
        6⤵
        
        PID:8204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46336.exe
        6⤵
        
        PID:13140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25433.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34463.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57650.exe
        5⤵
        
        PID:7132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55874.exe
        5⤵
        
        PID:10992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31787.exe
        5⤵
        
        PID:4804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12072.exe
      4⤵
      PID:4996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35515.exe
        5⤵
        
        PID:6216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50786.exe
        6⤵
        
        PID:8504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48418.exe
        6⤵
        
        PID:12656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56729.exe
        6⤵
        
        PID:17460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42745.exe
        6⤵
        
        PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48601.exe
        5⤵
        
        PID:5692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61467.exe
        6⤵
        
        PID:13388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28735.exe
        6⤵
        
        PID:17896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24972.exe
        6⤵
        
        PID:17580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11224.exe
        5⤵
        
        PID:12860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41961.exe
        5⤵
        
        PID:17096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52658.exe
      4⤵
      PID:6604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49321.exe
      4⤵
      PID:10040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31777.exe
      4⤵
      PID:13372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5834.exe
      4⤵
      PID:17552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39184.exe
      4⤵
      PID:17908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9457.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9457.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46770.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47627.exe
        5⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52955.exe
        6⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9610.exe
        7⤵
        
        PID:15852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18152.exe
        7⤵
        
        PID:7580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34415.exe
        6⤵
        
        PID:11968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48489.exe
        6⤵
        
        PID:14940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19720.exe
        6⤵
        
        PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34625.exe
        5⤵
        
        PID:8752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34031.exe
        5⤵
        
        PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41634.exe
        5⤵
        
        PID:14616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54857.exe
      4⤵
      PID:6992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7057.exe
      4⤵
      PID:9800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28897.exe
      4⤵
      PID:14584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9944.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9944.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19931.exe
      4⤵
      PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8522.exe
        5⤵
        
        PID:6368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53515.exe
        6⤵
        
        PID:7508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47250.exe
        6⤵
        
        PID:11648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37673.exe
        6⤵
        
        PID:13284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26793.exe
        6⤵
        
        PID:17540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18289.exe
        5⤵
        
        PID:8740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42201.exe
        5⤵
        
        PID:11664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22008.exe
        5⤵
        
        PID:15996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19272.exe
        5⤵
        
        PID:5552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9704.exe
      4⤵
      PID:6912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33547.exe
        5⤵
        
        PID:9160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15361.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7720.exe
        5⤵
        
        PID:17600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50690.exe
      4⤵
      PID:10356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1608.exe
      4⤵
      PID:13880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9905.exe
      4⤵
      PID:18184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34994.exe
      4⤵
      PID:1152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9297.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9297.exe
    3⤵
    PID:5544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45938.exe
      4⤵
      PID:6608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11489.exe
        5⤵
        
        PID:9420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7882.exe
        6⤵
        
        PID:16884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27560.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29585.exe
        5⤵
        
        PID:12188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56729.exe
        5⤵
        
        PID:17528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59465.exe
        5⤵
        
        PID:1372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31688.exe
      4⤵
      PID:6136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28271.exe
      4⤵
      PID:12784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41961.exe
      4⤵
      PID:17112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20431.exe
      4⤵
      PID:15660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45913.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45913.exe
    3⤵
    PID:7372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6776.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6776.exe
    3⤵
    PID:10264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2138.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2138.exe
    3⤵
    PID:13856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52144.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52144.exe
    3⤵
    PID:18108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41952.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41952.exe
    3⤵
    PID:17508
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26175.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26175.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27979.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27979.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44331.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58939.exe
        5⤵
        
        PID:4700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47627.exe
        6⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58635.exe
        7⤵
        
        PID:9876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14785.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30537.exe
        7⤵
        
        PID:16636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3135.exe
        7⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34625.exe
        6⤵
        
        PID:8760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2097.exe
        6⤵
        
        PID:11692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53929.exe
        6⤵
        
        PID:17432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15642.exe
        6⤵
        
        PID:15512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8257.exe
        5⤵
        
        PID:7056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8401.exe
        6⤵
        
        PID:16740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6481.exe
        5⤵
        
        PID:10936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61712.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50946.exe
        5⤵
        
        PID:5780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22545.exe
      4⤵
      PID:1532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5914.exe
        5⤵
        
        PID:5276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62539.exe
        6⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32731.exe
        7⤵
        
        PID:13128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5832.exe
        7⤵
        
        PID:17276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62985.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31401.exe
        7⤵
        
        PID:18288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2392.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53417.exe
        6⤵
        
        PID:14068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2625.exe
        6⤵
        
        PID:18324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9944.exe
        5⤵
        
        PID:8064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46363.exe
        6⤵
        
        PID:11360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17217.exe
        6⤵
        
        PID:15948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38992.exe
        6⤵
        
        PID:5672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6527.exe
        5⤵
        
        PID:9548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16433.exe
        5⤵
        
        PID:15324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35992.exe
        5⤵
        
        PID:16544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5103.exe
      4⤵
      PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37003.exe
        5⤵
        
        PID:8528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52569.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45312.exe
        5⤵
        
        PID:15036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10264.exe
        5⤵
        
        PID:5160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19633.exe
      4⤵
      PID:8552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56208.exe
      4⤵
      PID:4604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20657.exe
      4⤵
      PID:15368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56946.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56946.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10314.exe
      4⤵
      PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55115.exe
        5⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59483.exe
        6⤵
        
        PID:7996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31707.exe
        7⤵
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17000.exe
        7⤵
        
        PID:8040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9393.exe
        6⤵
        
        PID:12628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31928.exe
        6⤵
        
        PID:16724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6177.exe
        5⤵
        
        PID:8172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46377.exe
        5⤵
        
        PID:12132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36185.exe
        5⤵
        
        PID:2412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55216.exe
        5⤵
        
        PID:6880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54473.exe
      4⤵
      PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1066.exe
        5⤵
        
        PID:8564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35288.exe
        5⤵
        
        PID:12064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56729.exe
        5⤵
        
        PID:17484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31554.exe
      4⤵
      PID:8332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23992.exe
      4⤵
      PID:13232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48145.exe
      4⤵
      PID:16472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14615.exe
      4⤵
      PID:6396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59545.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59545.exe
    3⤵
    PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36667.exe
      4⤵
      PID:6128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57675.exe
        5⤵
        
        PID:9484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15169.exe
        5⤵
        
        PID:10796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27263.exe
        5⤵
        
        PID:17608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33176.exe
        5⤵
        
        PID:5652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52425.exe
      4⤵
      PID:6852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49008.exe
      4⤵
      PID:11728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27794.exe
      4⤵
      PID:15960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34271.exe
      4⤵
      PID:15644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4497.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4497.exe
    3⤵
    PID:5352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43323.exe
      4⤵
      PID:7728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20145.exe
      4⤵
      PID:10844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25176.exe
      4⤵
      PID:15064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57453.exe
      4⤵
      PID:16260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34984.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34984.exe
    3⤵
    PID:8300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28904.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28904.exe
    3⤵
    PID:11776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50411.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50411.exe
    3⤵
    PID:16332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29415.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29415.exe
    3⤵
    PID:5712
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34808.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34808.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33506.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33506.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-138.exe
      4⤵
      PID:1296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55115.exe
        5⤵
        
        PID:5204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28274.exe
        6⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37291.exe
        7⤵
        
        PID:16888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5329.exe
        7⤵
        
        PID:17324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20145.exe
        6⤵
        
        PID:10628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61056.exe
        6⤵
        
        PID:15128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25740.exe
        6⤵
        
        PID:11108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16840.exe
        5⤵
        
        PID:8908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55739.exe
        6⤵
        
        PID:17004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41016.exe
        6⤵
        
        PID:16444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28802.exe
        5⤵
        
        PID:11288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40208.exe
        5⤵
        
        PID:16172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16641.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56905.exe
      4⤵
      PID:5992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28274.exe
        5⤵
        
        PID:2804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5153.exe
        5⤵
        
        PID:11232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27480.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30633.exe
        5⤵
        
        PID:7692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3384.exe
      4⤵
      PID:7080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51801.exe
      4⤵
      PID:11364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50192.exe
      4⤵
      PID:15104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46472.exe
      4⤵
      PID:17868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62338.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62338.exe
    3⤵
    PID:4852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33979.exe
      4⤵
      PID:6000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65522.exe
        5⤵
        
        PID:11628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35000.exe
        5⤵
        
        PID:17340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31256.exe
        5⤵
        
        PID:6168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33857.exe
      4⤵
      PID:8832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31016.exe
      4⤵
      PID:11636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53170.exe
      4⤵
      PID:16532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52144.exe
      4⤵
      PID:16564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41728.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41728.exe
    3⤵
    PID:7104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34146.exe
      4⤵
      PID:16464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47209.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47209.exe
    3⤵
    PID:11012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45176.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45176.exe
    3⤵
    PID:14192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14807.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14807.exe
    3⤵
    PID:17592
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20401.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20401.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-138.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-138.exe
    3⤵
    PID:1056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47627.exe
      4⤵
      PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53515.exe
        5⤵
        
        PID:7512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50649.exe
        5⤵
        
        PID:11708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37289.exe
        5⤵
        
        PID:14452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43129.exe
        5⤵
        
        PID:3040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18289.exe
      4⤵
      PID:8732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46450.exe
        5⤵
        
        PID:16272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11032.exe
        5⤵
        
        PID:17496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7368.exe
      4⤵
      PID:10552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36818.exe
      4⤵
      PID:16012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52144.exe
      4⤵
      PID:16708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8257.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8257.exe
    3⤵
    PID:7040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9434.exe
      4⤵
      PID:9912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48233.exe
      4⤵
      PID:14632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1192.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1192.exe
    3⤵
    PID:9680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1713.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1713.exe
    3⤵
    PID:6904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31816.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31816.exe
    3⤵
    PID:16580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25643.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25643.exe
    3⤵
    PID:8160
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57467.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57467.exe
  2⤵
  PID:2728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63042.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63042.exe
    3⤵
    PID:6980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32731.exe
      4⤵
      PID:13044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54130.exe
      4⤵
      PID:17320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-463.exe
      4⤵
      PID:17128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6127.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6127.exe
    3⤵
    PID:10188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45433.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45433.exe
    3⤵
    PID:14640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15642.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15642.exe
    3⤵
    PID:448
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17927.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17927.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7092
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40089.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40089.exe
  2⤵
  PID:9888
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52977.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52977.exe
  2⤵
  PID:13300
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47482.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47482.exe
  2⤵
  PID:16628
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34833.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34833.exe
  2⤵
  PID:5828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4576 -ip 4576
1⤵
PID:1288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 6012 -ip 6012
1⤵
PID:4492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1652 -ip 1652
1⤵
PID:6272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 12176 -ip 12176
1⤵
PID:16028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 15188 -ip 15188
1⤵
PID:17348

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10298.exe

Filesize
468KB

MD5
1c1b99f2e450784b98684ffbaed7718f

SHA1
03f5c8fe8c0127bed8d1282eec5b4441a6df5c42

SHA256
2922542c4745d1fe965b9d5dd369dfb043c012ae527ba7501d4de0d9a7b134f1

SHA512
ceea566a7718ad5fb897d5d6d75ff0427eb25af780541a53e8650e63bd49cebae874e3daa709b668a4532a461f318d978a061a1a3be851de6a572ddef1c13697

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15986.exe

Filesize
468KB

MD5
80315f953f771be12b42f76776b5f355

SHA1
70304497e49834d15b394555370a47f87a56449f

SHA256
d7a4e3969f1d20333c5980a520634883b3f62115f632f948c6ec4f2883ebb14f

SHA512
812f206a21a2cfa49883d8e203561caea4af2f996b20fb65ebe78c75a8349c15940a0b251a18de8f6b241844a48fb325364c526c85d313de98a304c6786d5c85

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20030.exe

Filesize
468KB

MD5
db6d203a6874b9ae04a04bf91794bcf7

SHA1
a8c7cc42e6be5149d7b76eb5771b2e42e776df37

SHA256
fc8452b7bbe303c89cbceeae2cfd1cc915aa8a1e721ec7d3264047207f4777fb

SHA512
226e0dda2414a3a465a12d560af31c2e3e0265b859ff90dc1c850b6e2fe82c47b42163ade3d49ed0720204ef200773a1b79149d63306b0f310c8d4240e988e97

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21704.exe

Filesize
468KB

MD5
c96ecbc2d04639505ed65b6ebb259d7c

SHA1
26bd3d85ac37310eb207b238bcc7dfd0d0595f76

SHA256
3c6a2d40d42872b49832d610519999ac579edd8afd4bd9db9deb8b3f820f7191

SHA512
5af997fcf3b8a6cc1cfdba8e39a7b56d4c79d1d2254772af18ba514ed5e4314f723996a2e04ed81e34d198e5ce95ca92755d11a9f40266f8936056d61e3eee4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23192.exe

Filesize
468KB

MD5
b0870d2cbb4d27be98ecc3dfb39453ce

SHA1
8ee544a36cd26fabec67f4f3600c1c5165bbd377

SHA256
7239e15aff85e4f932175808fa2cec1a89c81e65c87cca81121f6ca2c0ac021b

SHA512
54244043fb78f3d021f9d5412a35e7b8eaac344e8c570712195cd9e5d349ea1d6ce98ed2a037e998af3b483d0f9822a64176f2a282230b23be58db1fc8b58c34

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23752.exe

Filesize
468KB

MD5
6e8d2b5fd40428f26fbef9bdc9636874

SHA1
f725820d75f82aeba5c06094826352c6c3a2a77f

SHA256
3079962b9c526baf284771f3c1f7b57124bde944ea550b3ad2ef8f2407bb7917

SHA512
db7cb1d04800b8f504856b4e9e837b62772394341668b153b4638ae76b8b720ac5cb3bd68e70c96e8e89fb6ae21b000aa79ab03eaa9e245212828dfecb43fc7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2392.exe

Filesize
468KB

MD5
049195c12dc68c21169b71a02b0cd7e8

SHA1
d82db751e2f28e017a9992dc6c75e7e465c3e60e

SHA256
b1047c59eb9f2eb16f7cf8fba04e274dc033708d576aa0326c56e0ab9cbea6f8

SHA512
811b2a84f677909804d469693d072c50be5e661afab591cd5977612632246a448f23396c54f5aea173de31f323e20d43df688d0c0faee7042a9848da3de6a5fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25793.exe

Filesize
468KB

MD5
beb5f8b3b43f986a0edc23302ef92bb4

SHA1
5e054c9eeee69c49ebcebb99e025f5e96fd3cf79

SHA256
02f276ddd0cebe884e3ea270ca38e96702aa806140d623605f117e209952571b

SHA512
d7595af6cc6765e3e0979dc5fbf8763a73861a676521361928ebd2c381de239b588c1fd1592808d93de2de1f7ebb04d8b30a03ba8d8d196ab66db55de5ee835e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25899.exe

Filesize
468KB

MD5
1369f4bb702dcb987ae722a6a7c14e67

SHA1
731e8475fb27f4a4b73f8eccddf1673c4df30e4b

SHA256
8587c02c2b3a3a61f3f7151b4ad30920386f129fb71ca2900d6cae484ae96f99

SHA512
a7305eb171af4b31f5bd6562ed9831ee90f11c9a20c7af4c4875f2343fcaa1cf7512cb47a75e9dc8bedeae343ba6593ec5f6cd23563cd6dbfe8eb5d822870d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26175.exe

Filesize
468KB

MD5
a3fa0c78f82173d9bb7b781121aaf384

SHA1
2f96268ba6e025abcf8bdac8b61377c6d1c03abb

SHA256
e05558b73402a31dc43b7c5d2b66b80313986e659064279692a4989ad60e5b75

SHA512
a1e19975437508da0e4a525fca95ff8897628dc29de1895c07b1cd33f3109baa93763f1d3616a2ed53490c7cb757ce738a2c0ede51d719afd9d1488c18c54e1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27211.exe

Filesize
468KB

MD5
3eb2695f7cc1d8d280d31622068b9a3e

SHA1
8395a15fdf268a22bdc474c7b0ee41245777c414

SHA256
d44f3149a933b41953a297edbd45643a3b1c0de6902c9a25e44e68753e16676d

SHA512
00231e9d8fd31b941aea8f92cc4aebcf083f0147ce0bbd23e6d221262977dfef043072d2614a8bd5b3a769fe8885c602c3c8dafbb98ca4b878cb0ecff6280b45

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27979.exe

Filesize
468KB

MD5
45b8a57bd59a009a2427e8e3edf8c3e3

SHA1
53bb37a16949e9e8e05b8badae927ecf78fa4722

SHA256
6cce86f70abbe3a748f9972fd32461090344e724876f7c15935544c64ea3fd37

SHA512
7acc0e60e7e4a753b2e97f8e413e340a9e7814b9efcc0ca0118c3666b3c8934a37ca346e3ec361f47e89103bf0059e8af132d04fe86ac3e28c2d864c93a31a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29058.exe

Filesize
468KB

MD5
9c48f7fe5156135e61aca272dee40acc

SHA1
f1aabae92ac62f1e5589571176bdcd9365e2c863

SHA256
356865a822aa0130eccf43af29b86513d5b282a72914398ffc5253e84761ad77

SHA512
a3a983b4a269d58ce62472d75107c065f28b9cb05fb1ced59bc008f74b890741e63fd9b95341013b95ab8aa9b5b97fc8c16cf53af97944a1b15c3906e3481b5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29323.exe

Filesize
468KB

MD5
d98d9b4f24f61c9b737c11f244c78197

SHA1
89ab1fa8def3b26c993cf2b8f6ef1ab58f82e620

SHA256
474a33f50b41648c073606216bc25e7f4e1f20fbab8be74a1bcae9790e846be8

SHA512
1bd66ac86d4701918db36c7e949c87b87f8451ce36bbc1aed22f164dce697506d2b5f47a179c71d987a68719ddb9699d1c46ac6d0c6cce4c42701059dbd9a0c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34808.exe

Filesize
468KB

MD5
14bab43b98da0277bdb6e3f360718ba6

SHA1
7face60487b688c96c8e11d298344cf1312a84ef

SHA256
7f2e22a6f8a8ae18a003e083697292d6757ca214bb2f80133eaae574c9c4a206

SHA512
3159568c199ee3aac88e30dfc86c9a62cf6009b8fce996a28264f364aa2e565fcc3999b844de7432ff63bddeec4d558bffb11e8ad17d4d7691610bd35137b4b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36454.exe

Filesize
468KB

MD5
97da5486ad69cf7ca1f517656656d06f

SHA1
640371d91b9677f2f4d64da9170dfb83870ba219

SHA256
6384f8f9b8c21b01d6851ef7b62e7811b83c6cc1e6ae7e28968ad8fa26962631

SHA512
d1810b20ae371a8e416d682a6630e5ffef558e31d9340cbab2372356ce3da30854bc3209008b7b73f5e7a6296ddde17864112a01b951baf8838e2d65ebb81c8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37384.exe

Filesize
468KB

MD5
883f735503c296b9b20104aa94f0724f

SHA1
96852263a1275e66f998d86bb0bb587f6d74ce40

SHA256
8363dc21f1dfe65e688929f7c02e96b35753c59c32b4c2a1785d7a5ef1e06db2

SHA512
db4c2f56ca19e0d7fce040c8e2c329faf5d3cd7ab631fd32e231080b5ffc2c9b239f02e332d859306460caa79cf41a497afa2e9987125176a935636d7f29614b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37576.exe

Filesize
468KB

MD5
0f244084a771e1ae583ee93cbc5b0440

SHA1
156f3d4260c1c5fdaf0b9be62715a5bf57da15c4

SHA256
d1fb186e2226e36c5aa80701a16e7936972e50fd646a5ae784a99ecebface370

SHA512
7032e9010bf5f15a50712abdf0afe1e5b0dea851ee9ef79d503198934e20499c53dd94b03b9699846cab749c42fb9e7cdcc406732426ae8ac6016f85d44d1ece

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40472.exe

Filesize
468KB

MD5
8560402c4668c43ff9261229e0947f45

SHA1
74f5c7b73ca34b760fcc291e3b3cb52c0530d4bb

SHA256
ecdd93d2d6e96cc9c21de9a33ac2c9d9695fb90ffb0cc67a7f7e2daabfd5b1f1

SHA512
93a0bc85915caf95ff15586c5102607ad1a3c6ffb39df572feacb147c1999c731c8c56216bf64bb438722644b18daeaeacf9ea16477b4b2e199cf6f33310433a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41800.exe

Filesize
468KB

MD5
ee40338b4c6bdd6646c70ac0ff4707aa

SHA1
f8b761e9eb4efc595402d0fd35c4048a5f3ef999

SHA256
27a2a9288c1d85240d02e456e95bcbae662aa41a5315952fc65e79ebf47ed996

SHA512
1ba26e33f1663905e611e698318db57ca9d700916c9472bd9b38ef8341e6eff93a95b11b9143256b95227c5b7627953dd4daad4732dd1a0cfe526dc740adf21e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42360.exe

Filesize
468KB

MD5
013cec23ae15b526d71c6f4a202a2723

SHA1
4fd915d00233a3bea293a44443475b6f032478b4

SHA256
3d65e13bca7357766d1c90bc1336792c93b05947cd1535b37bd1216ea809b336

SHA512
49466c8cbc3bcee2f54529f8741e2bf31793195909fcca988c0e4fbaf6d7727cda069195fc399057af7380bcfcd6f8262c61d55057b860b9d3eacd862939e4e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42584.exe

Filesize
468KB

MD5
c473d5ad31463ec0b51d30b4d4c332f4

SHA1
d99f267d40af28dcee94191dff3aebc357971d8d

SHA256
27c529f3cef82fe925af83d8c838d352c3beb4f0d6500be6352a46ed512edb73

SHA512
db89e8fdcc73fdf0f0b852a2915a97c18d1526d4f6ed9e0edf7870f7fafba05c806614033411ade36bf8948ac2be9b716b186a5d6ec1bb2e152cdeedec49c619

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43547.exe

Filesize
468KB

MD5
35a3f7dca8c6c22ad6e23a69ea04818c

SHA1
9e0e112adb8fb96cb6560f527ce511a24ffd6899

SHA256
896dfdfed7c5c2b081d0e2ff41e62e256cc877cd9660503536d72806721bd74e

SHA512
7a80a0da773bfaad2f9aa4cc91426e418056e769c42b6d19a1a7a93c5dd05441732fdca350b49872ab9db21843ff40a275943136593d8bd2c17c915dd9ba0b57

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45659.exe

Filesize
468KB

MD5
b76f983158f1cdae0f720207f8efa641

SHA1
ea666ca21d3db191c2f98e22d67df28c26713604

SHA256
571440cccd181a374b2f7a58cfd314f3a67987b3eb00072b8179674bbef95946

SHA512
8cecb930fc2061cb9b019e9f09c7660f661ee1a518204912e6f4360d3e731ed7769b5f21ea655a81a00cda77647dc2d2f9fbd7c973be98fd848afe58655008d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48601.exe

Filesize
468KB

MD5
9f23c21cf677151af805f58c1992309d

SHA1
47f44a45eacc6ad4b5cb094f1cd1484d933fe3b7

SHA256
67556a1a9b40b9a843bd3c9176405cb988e48aa62dcc16ec53fe9bef7d761c6c

SHA512
1eddffbc3fc83b00c5ea0f6d9209b95e7fa06cc3c7297e87337714adf2b0b98340e16d6055f47ec77e91d68d9f8317ba5c7d5bd6a4258543fd882ce182e060f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50191.exe

Filesize
468KB

MD5
780601a9fe08ab9e55a45d65905262b5

SHA1
85c6a2130957b24fdfc10e81335c588f75a408eb

SHA256
17a8b9bc5e6cc1163fbd1e35ad570ebdb061e8f5cbff39df4b4fab9c1f925320

SHA512
5df3291ba487c1f6c1c88711120d5521d5ea75d81c9ef56353f7082f22e92fa2fd635ded1a22c8da675968b981e4e7fc39e41e59bc1ec9332cb8b22436d2dcad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5022.exe

Filesize
468KB

MD5
c99398737f68ff5858acad2aad2fc21f

SHA1
8ea2963e69ae3e0ee644f204db2e77fa107f1cf9

SHA256
dcf9f3f24c3fffe16925f5481f8bcff44f1f9e557dff91baf261c63ccb1fafa8

SHA512
14a2ab174e3eeeb0febb25688ca6aef00e69630ddf46bb1b76647a37f89ebe96907cd1c80fff17f1fff63b642d4471aff26b26ed382de0c77f87e50548b9033e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5032.exe

Filesize
468KB

MD5
c8a39f47300aaa4094291b0715bedb52

SHA1
d50f072840deec8efe8675c1e3b87e99594fbd15

SHA256
6e020b2b1cc277a978f2f419dc7210fb0eefb4d54c38ecd386733aa579e97219

SHA512
b47717d751ef75308f3ce79edd1448ff8048a8595b2053d73dfbe1a11dc08a767370a16ec14ce3fc55f909666e86177d8a87138a41e13163b133579c995f228c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5271.exe

Filesize
468KB

MD5
4469a64055d5cac7bd15bd037e1f0e51

SHA1
bfe8fd110a10d789549a604c6084aa2b72b0b49e

SHA256
70b6e180a78f01babe36c13dd3e66d1245d7b8b402cd997f3e17d104506a7937

SHA512
afd3278746b6672836733030e5409199fc22f864ee824ed9e2a8d9b25938bd1397ce12f0b6e6bc7eae13735e68467763c5145300433f7b7bc1aa4cafe8d2ea10

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54434.exe

Filesize
468KB

MD5
87785d219bf77f75d468377bc0bce542

SHA1
e263178333765eed2435360e7605e6c3f9e819c3

SHA256
29681c7e9a6967ef444a792f9b79a474d209fd557c57d6a6d10d2ddeaf3d4cf7

SHA512
9bf10d1720a5c6f2475a65d40c76a4c1949e859a6baf59184c44796c49510f8429d6fe68c12c089b0cd46d852cd6fced05e12137e9a2fd6b788096e644f6172a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5690.exe

Filesize
468KB

MD5
aa18274f6f8c9b990390a02ecaaa058d

SHA1
4d91443fed2b5f2db4ba62753b21a29eb47f5616

SHA256
2962fa4b7a2782ad73ae90f0648284c287bfd1e6f1370f540236f1254df0f0df

SHA512
baeb079045874bc361375b01b5fd43faa7d99081b5424698ac5aa31ce2be1c35f00c2b2f2f20cb3f92c92115961c4437ccdb01205f02e2a24719c8fd7fef8553

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58920.exe

Filesize
468KB

MD5
4b3c6b08fad34f05c14746c048f5bada

SHA1
a72314a39d836472f220fb47011d525b389be17d

SHA256
15bdd56696b5c4df373853ec59636b8f5dd70a4ba450f3e39d84f1ae1222063c

SHA512
75faeedecf8202e81d07563121c7fcb9623426b69424949289873c8d5c8fdc6d780a41f688a95cf6518092878e11fb5e5aaa98177778f5c0796369ecd83658d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6574.exe

Filesize
468KB

MD5
d93fded94e46b4de41c81c1b740c0685

SHA1
7b5798d8f01bedeb315e2dc734efa46aa9f4303e

SHA256
dd6c4c3d7d110c84ad66081cb09045b58b98afc5b7731a857c089c763628acea

SHA512
80e291a945cf4e81f65ba2fd5c785a89c5239332c0fc2936bdc2d4ec9d3c852b2ac20cda8901342936d01188f4c70538a69e3f7ce1fcc55ec52ef4d0d7fd1464

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9146.exe

Filesize
468KB

MD5
42b61955ee0e59e082076c85ab362016

SHA1
e32d878dafb19e20e3c05b88ba3e7ce63df7bf7f

SHA256
c113fbd092ff7317fcbaccb0a6972218975c028234d579a00f8c8b11507b4a97

SHA512
e9a43e65632cd509433cc250b83d6378e2a5e2c290ab07eeff94768e27bcbc48392c1b5ed931087215f57bc1bec9eb84e53f257dbbc1806231c58579e63afa6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9457.exe

Filesize
468KB

MD5
94947043b63be79a32769ac99b1d05b9

SHA1
91e2050699f8fb3884ba8779851961c7a3f1f9db

SHA256
b1ae66171d320bd762e36c5f0c73babc1b42e350dd09692fba1eb3581f7e68c4

SHA512
c44dbfd8f243270d7ba419a8be5b45730957f52d91fb8a41a885058b3b5d1504b163e8a07f6db29a04c3d45948273c8a49ef0adce658cc17565a326eee60049b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9649.exe

Filesize
468KB

MD5
d0f2d258cb729c81aece8451d9fefe64

SHA1
b83e2f2b870425a7746c9655fd90d966de14811c

SHA256
f84032aa29d2c5977edf367689eebdc309c22be05d30524856f3efce822e5919

SHA512
39d7639fa66d384c15d235be4b7657235c2f00ac9428e2886b53d50894345262c9000eab996c505b79f328b1f60f8c47d86ab013319318ae5cef94ec83e35c84

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads