efeb9141f96d50ee8cb56971458a1fcf45abac9c4bf9a42543dd0901b9e636a2

Analysis

max time kernel
150s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 03:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
efeb9141f96d50ee8cb56971458a1fcf45abac9c4bf9a42543dd0901b9e636a2.exe
Size 468KB
Sample240919-dstnesycml
SHA256 efeb9141f96d50ee8cb56971458a1fcf45abac9c4bf9a42543dd0901b9e636a2
MD5 19fe94289c496282b849be20728f6f2a
SHA1 472f0f735e945859bb6df1b314ad527bdd42b1e8
SHA512 907cc6de10d9301a0c514d5714b91aadb978a9af537e5c3da5cd4a65cacc2baadd62fc28bb6580749c44e9105dc76a0c05b7ec73bc2b4e949bbd45f2fd246e33
SSDEEP 3072:SO0soglEIV5jtbY94AcTJf8w4ChCSppLJEHCxFWAJHLLQAqughlf:SO/o0jjtS4dTJfhfxHJHPhqug
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4600	Unicorn-23524.exe
3564	Unicorn-22781.exe
3216	Unicorn-42647.exe
844	Unicorn-56404.exe
628	Unicorn-3482.exe
2276	Unicorn-33745.exe
5060	Unicorn-39876.exe
1976	Unicorn-41895.exe
3636	Unicorn-54894.exe
4752	Unicorn-9715.exe
876	Unicorn-42580.exe
4052	Unicorn-42580.exe
1684	Unicorn-36450.exe
1688	Unicorn-42315.exe
5068	Unicorn-6378.exe
4492	Unicorn-59508.exe
4904	Unicorn-59508.exe
4272	Unicorn-36850.exe
3460	Unicorn-41946.exe
4120	Unicorn-60167.exe
3688	Unicorn-38386.exe
5100	Unicorn-10774.exe
2232	Unicorn-29726.exe
2168	Unicorn-31060.exe
3588	Unicorn-47204.exe
3248	Unicorn-59134.exe
4076	Unicorn-54418.exe
4712	Unicorn-43482.exe
4916	Unicorn-43482.exe
4332	Unicorn-25972.exe
4524	Unicorn-38970.exe
4136	Unicorn-25588.exe
640	Unicorn-38586.exe
380	Unicorn-58452.exe
3288	Unicorn-41851.exe
4476	Unicorn-40855.exe
4112	Unicorn-19073.exe
2656	Unicorn-44747.exe
2196	Unicorn-44747.exe
2020	Unicorn-15796.exe
4340	Unicorn-32324.exe
3108	Unicorn-18676.exe
2684	Unicorn-18410.exe
980	Unicorn-42610.exe
4452	Unicorn-64155.exe
4540	Unicorn-18484.exe
4556	Unicorn-2147.exe
5096	Unicorn-15146.exe
5012	Unicorn-12161.exe
5088	Unicorn-51156.exe
2104	Unicorn-25690.exe
3184	Unicorn-18100.exe
4984	Unicorn-63771.exe
4988	Unicorn-1763.exe
3784	Unicorn-63579.exe
4284	Unicorn-11777.exe
3424	Unicorn-9651.exe
2460	Unicorn-25530.exe
3776	Unicorn-44244.exe
1188	Unicorn-20516.exe
3252	Unicorn-13683.exe
4328	Unicorn-12806.exe
3576	Unicorn-12806.exe
4792	Unicorn-12806.exe

Program crash 20 IoCs

pid	pid_target	Process	procid_target
1792	9956	WerFault.exe	475
18348	17744	WerFault.exe	868
17480	4496	WerFault.exe	798
9416	16292	WerFault.exe	793
4416	16476	WerFault.exe	800
18356	16524	WerFault.exe	804
16376	16868	WerFault.exe	815
1712	16712	WerFault.exe	811
4740	17020	WerFault.exe	825
11844	5800	Process not Found	1077
11756	2544	Process not Found	1040
11740	16240	Process not Found	1010
11720	17936	Process not Found	1006
18616	7216	Process not Found	1156
9700	7164	Process not Found	1151
9444	5344	Process not Found	1164
14096	14100	Process not Found	1432
10664	10768	Process not Found	1536
4504	10448	Process not Found	1580
17236	14440	Process not Found	1546

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44244.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7731.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3076.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27551.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2147.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1245.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35113.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61157.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45813.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33127.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1162.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7539.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46875.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9005.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63148.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60167.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49019.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54462.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61506.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44546.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61883.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35813.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3587.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49011.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45739.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25348.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9949.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14189.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63373.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26482.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47483.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62593.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64535.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12605.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60325.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25348.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16999.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
15944	svchost.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
232	efeb9141f96d50ee8cb56971458a1fcf45abac9c4bf9a42543dd0901b9e636a2.exe
4600	Unicorn-23524.exe
3216	Unicorn-42647.exe
3564	Unicorn-22781.exe
844	Unicorn-56404.exe
5060	Unicorn-39876.exe
628	Unicorn-3482.exe
2276	Unicorn-33745.exe
1976	Unicorn-41895.exe
3636	Unicorn-54894.exe
4752	Unicorn-9715.exe
5068	Unicorn-6378.exe
1688	Unicorn-42315.exe
1684	Unicorn-36450.exe
876	Unicorn-42580.exe
4052	Unicorn-42580.exe
4492	Unicorn-59508.exe
4904	Unicorn-59508.exe
4272	Unicorn-36850.exe
3460	Unicorn-41946.exe
4120	Unicorn-60167.exe
3688	Unicorn-38386.exe
5100	Unicorn-10774.exe
2232	Unicorn-29726.exe
3588	Unicorn-47204.exe
4712	Unicorn-43482.exe
4076	Unicorn-54418.exe
2168	Unicorn-31060.exe
3248	Unicorn-59134.exe
4916	Unicorn-43482.exe
4332	Unicorn-25972.exe
4524	Unicorn-38970.exe
4136	Unicorn-25588.exe
380	Unicorn-58452.exe
3288	Unicorn-41851.exe
640	Unicorn-38586.exe
4476	Unicorn-40855.exe
4112	Unicorn-19073.exe
2196	Unicorn-44747.exe
2656	Unicorn-44747.exe
2020	Unicorn-15796.exe
4340	Unicorn-32324.exe
3108	Unicorn-18676.exe
2684	Unicorn-18410.exe
4540	Unicorn-18484.exe
980	Unicorn-42610.exe
4452	Unicorn-64155.exe
5012	Unicorn-12161.exe
5096	Unicorn-15146.exe
5088	Unicorn-51156.exe
4556	Unicorn-2147.exe
2104	Unicorn-25690.exe
3184	Unicorn-18100.exe
4284	Unicorn-11777.exe
4988	Unicorn-1763.exe
3784	Unicorn-63579.exe
3424	Unicorn-9651.exe
2460	Unicorn-25530.exe
3776	Unicorn-44244.exe
1188	Unicorn-20516.exe
3252	Unicorn-13683.exe
3576	Unicorn-12806.exe
4328	Unicorn-12806.exe
4448	Unicorn-12806.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 232 wrote to memory of 4600	232	efeb9141f96d50ee8cb56971458a1fcf45abac9c4bf9a42543dd0901b9e636a2.exe	86
PID 232 wrote to memory of 4600	232	efeb9141f96d50ee8cb56971458a1fcf45abac9c4bf9a42543dd0901b9e636a2.exe	86
PID 232 wrote to memory of 4600	232	efeb9141f96d50ee8cb56971458a1fcf45abac9c4bf9a42543dd0901b9e636a2.exe	86
PID 232 wrote to memory of 3564	232	efeb9141f96d50ee8cb56971458a1fcf45abac9c4bf9a42543dd0901b9e636a2.exe	89
PID 232 wrote to memory of 3564	232	efeb9141f96d50ee8cb56971458a1fcf45abac9c4bf9a42543dd0901b9e636a2.exe	89
PID 232 wrote to memory of 3564	232	efeb9141f96d50ee8cb56971458a1fcf45abac9c4bf9a42543dd0901b9e636a2.exe	89
PID 4600 wrote to memory of 3216	4600	Unicorn-23524.exe	88
PID 4600 wrote to memory of 3216	4600	Unicorn-23524.exe	88
PID 4600 wrote to memory of 3216	4600	Unicorn-23524.exe	88
PID 3216 wrote to memory of 844	3216	Unicorn-42647.exe	92
PID 3216 wrote to memory of 844	3216	Unicorn-42647.exe	92
PID 3216 wrote to memory of 844	3216	Unicorn-42647.exe	92
PID 4600 wrote to memory of 628	4600	Unicorn-23524.exe	93
PID 4600 wrote to memory of 628	4600	Unicorn-23524.exe	93
PID 4600 wrote to memory of 628	4600	Unicorn-23524.exe	93
PID 232 wrote to memory of 2276	232	efeb9141f96d50ee8cb56971458a1fcf45abac9c4bf9a42543dd0901b9e636a2.exe	94
PID 232 wrote to memory of 2276	232	efeb9141f96d50ee8cb56971458a1fcf45abac9c4bf9a42543dd0901b9e636a2.exe	94
PID 232 wrote to memory of 2276	232	efeb9141f96d50ee8cb56971458a1fcf45abac9c4bf9a42543dd0901b9e636a2.exe	94
PID 3564 wrote to memory of 5060	3564	Unicorn-22781.exe	95
PID 3564 wrote to memory of 5060	3564	Unicorn-22781.exe	95
PID 3564 wrote to memory of 5060	3564	Unicorn-22781.exe	95
PID 844 wrote to memory of 1976	844	Unicorn-56404.exe	96
PID 844 wrote to memory of 1976	844	Unicorn-56404.exe	96
PID 844 wrote to memory of 1976	844	Unicorn-56404.exe	96
PID 3216 wrote to memory of 3636	3216	Unicorn-42647.exe	97
PID 3216 wrote to memory of 3636	3216	Unicorn-42647.exe	97
PID 3216 wrote to memory of 3636	3216	Unicorn-42647.exe	97
PID 2276 wrote to memory of 4752	2276	Unicorn-33745.exe	98
PID 2276 wrote to memory of 4752	2276	Unicorn-33745.exe	98
PID 2276 wrote to memory of 4752	2276	Unicorn-33745.exe	98
PID 628 wrote to memory of 876	628	Unicorn-3482.exe	99
PID 628 wrote to memory of 876	628	Unicorn-3482.exe	99
PID 628 wrote to memory of 876	628	Unicorn-3482.exe	99
PID 5060 wrote to memory of 4052	5060	Unicorn-39876.exe	100
PID 5060 wrote to memory of 4052	5060	Unicorn-39876.exe	100
PID 5060 wrote to memory of 4052	5060	Unicorn-39876.exe	100
PID 4600 wrote to memory of 1684	4600	Unicorn-23524.exe	101
PID 4600 wrote to memory of 1684	4600	Unicorn-23524.exe	101
PID 4600 wrote to memory of 1684	4600	Unicorn-23524.exe	101
PID 232 wrote to memory of 1688	232	efeb9141f96d50ee8cb56971458a1fcf45abac9c4bf9a42543dd0901b9e636a2.exe	102
PID 232 wrote to memory of 1688	232	efeb9141f96d50ee8cb56971458a1fcf45abac9c4bf9a42543dd0901b9e636a2.exe	102
PID 232 wrote to memory of 1688	232	efeb9141f96d50ee8cb56971458a1fcf45abac9c4bf9a42543dd0901b9e636a2.exe	102
PID 3564 wrote to memory of 5068	3564	Unicorn-22781.exe	103
PID 3564 wrote to memory of 5068	3564	Unicorn-22781.exe	103
PID 3564 wrote to memory of 5068	3564	Unicorn-22781.exe	103
PID 3636 wrote to memory of 4492	3636	Unicorn-54894.exe	104
PID 3636 wrote to memory of 4492	3636	Unicorn-54894.exe	104
PID 3636 wrote to memory of 4492	3636	Unicorn-54894.exe	104
PID 1976 wrote to memory of 4904	1976	Unicorn-41895.exe	105
PID 1976 wrote to memory of 4904	1976	Unicorn-41895.exe	105
PID 1976 wrote to memory of 4904	1976	Unicorn-41895.exe	105
PID 3216 wrote to memory of 4272	3216	Unicorn-42647.exe	106
PID 3216 wrote to memory of 4272	3216	Unicorn-42647.exe	106
PID 3216 wrote to memory of 4272	3216	Unicorn-42647.exe	106
PID 844 wrote to memory of 3460	844	Unicorn-56404.exe	107
PID 844 wrote to memory of 3460	844	Unicorn-56404.exe	107
PID 844 wrote to memory of 3460	844	Unicorn-56404.exe	107
PID 5068 wrote to memory of 4120	5068	Unicorn-6378.exe	108
PID 5068 wrote to memory of 4120	5068	Unicorn-6378.exe	108
PID 5068 wrote to memory of 4120	5068	Unicorn-6378.exe	108
PID 3564 wrote to memory of 3688	3564	Unicorn-22781.exe	109
PID 3564 wrote to memory of 3688	3564	Unicorn-22781.exe	109
PID 3564 wrote to memory of 3688	3564	Unicorn-22781.exe	109
PID 1684 wrote to memory of 5100	1684	Unicorn-36450.exe	110

C:\Users\Admin\AppData\Local\Temp\efeb9141f96d50ee8cb56971458a1fcf45abac9c4bf9a42543dd0901b9e636a2.exe
"C:\Users\Admin\AppData\Local\Temp\efeb9141f96d50ee8cb56971458a1fcf45abac9c4bf9a42543dd0901b9e636a2.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:232
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23524.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23524.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56404.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41895.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59508.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25588.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12806.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32039.exe
        9⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21709.exe
        10⤵
        
        PID:7896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31665.exe
        10⤵
        
        PID:9304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20157.exe
        10⤵
        
        PID:15792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26714.exe
        9⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12337.exe
        9⤵
        
        PID:10604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9005.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:14820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48013.exe
        9⤵
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45531.exe
        8⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29476.exe
        9⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61726.exe
        9⤵
        
        PID:10324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-68.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-68.exe
        9⤵
        
        PID:14536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28366.exe
        9⤵
        
        PID:17500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40642.exe
        8⤵
        
        PID:7824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17133.exe
        8⤵
        
        PID:10572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34465.exe
        8⤵
        
        PID:14724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14364.exe
        8⤵
        
        PID:18012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe
        7⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57524.exe
        8⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36884.exe
        9⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9261.exe
        9⤵
        
        PID:10596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45813.exe
        9⤵
        
        PID:14816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48552.exe
        9⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44974.exe
        8⤵
        
        PID:8548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31940.exe
        8⤵
        
        PID:11504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29307.exe
        8⤵
        
        PID:16016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22682.exe
        8⤵
        
        PID:17988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36210.exe
        7⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56759.exe
        8⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18205.exe
        8⤵
        
        PID:11600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39202.exe
        8⤵
        
        PID:16212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38852.exe
        8⤵
        
        PID:17452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8653.exe
        7⤵
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39525.exe
        7⤵
        
        PID:12344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61182.exe
        7⤵
        
        PID:16624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62813.exe
        7⤵
        
        PID:17428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38586.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13683.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29735.exe
        8⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62615.exe
        9⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31850.exe
        9⤵
        
        PID:10488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34961.exe
        9⤵
        
        PID:14696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7424.exe
        9⤵
        
        PID:17956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41597.exe
        8⤵
        
        PID:7968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7428.exe
        8⤵
        
        PID:10752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4122.exe
        8⤵
        
        PID:15376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12173.exe
        7⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21709.exe
        8⤵
        
        PID:7648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31665.exe
        8⤵
        
        PID:9408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20157.exe
        8⤵
        
        PID:15776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55333.exe
        7⤵
        
        PID:7964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50068.exe
        8⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        7⤵
        
        PID:9908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62146.exe
        7⤵
        
        PID:15648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48013.exe
        7⤵
        
        PID:4816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38965.exe
        6⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41188.exe
        7⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56759.exe
        8⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-634.exe
        8⤵
        
        PID:11420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23441.exe
        8⤵
        
        PID:15952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64897.exe
        8⤵
        
        PID:17380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54590.exe
        7⤵
        
        PID:8256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10529.exe
        7⤵
        
        PID:11716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22299.exe
        7⤵
        
        PID:16508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29594.exe
        7⤵
        
        PID:2240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57726.exe
        6⤵
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15181.exe
        7⤵
        
        PID:8936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35506.exe
        7⤵
        
        PID:11316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20269.exe
        7⤵
        
        PID:16200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29402.exe
        7⤵
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55909.exe
        6⤵
        
        PID:8536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57687.exe
        7⤵
        
        PID:13224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9901.exe
        7⤵
        
        PID:17140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12605.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36932.exe
        6⤵
        
        PID:16092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22683.exe
        6⤵
        
        PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41946.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40855.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12806.exe
        7⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64135.exe
        8⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14291.exe
        9⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63262.exe
        9⤵
        
        PID:10512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37266.exe
        9⤵
        
        PID:14772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13834.exe
        9⤵
        
        PID:18284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2410.exe
        8⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7812.exe
        8⤵
        
        PID:11136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20157.exe
        8⤵
        
        PID:15716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        8⤵
        
        PID:17868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12941.exe
        7⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46772.exe
        8⤵
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9265.exe
        8⤵
        
        PID:636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4589.exe
        8⤵
        
        PID:15564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        8⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39874.exe
        7⤵
        
        PID:7940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13293.exe
        7⤵
        
        PID:9992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60994.exe
        7⤵
        
        PID:15252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe
        6⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24410.exe
        7⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6230.exe
        8⤵
        
        PID:9652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47438.exe
        8⤵
        
        PID:12304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3076.exe
        8⤵
        
        PID:17416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8483.exe
        8⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31828.exe
        7⤵
        
        PID:8804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13613.exe
        7⤵
        
        PID:14012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        7⤵
        
        PID:18024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59474.exe
        6⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60082.exe
        6⤵
        
        PID:11104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34157.exe
        6⤵
        
        PID:15104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15155.exe
        6⤵
        
        PID:18040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41282.exe
        6⤵
        
        PID:18216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19073.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45095.exe
        6⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43108.exe
        7⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24279.exe
        8⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18205.exe
        8⤵
        
        PID:11560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39202.exe
        8⤵
        
        PID:16148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62593.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32196.exe
        7⤵
        
        PID:9628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28014.exe
        7⤵
        
        PID:9468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33908.exe
        7⤵
        
        PID:17304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48243.exe
        7⤵
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46590.exe
        6⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41124.exe
        7⤵
        
        PID:9120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9949.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46309.exe
        7⤵
        
        PID:4496
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 464
        8⤵
        Program crash
        
        PID:17480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48552.exe
        7⤵
        
        PID:18160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45653.exe
        6⤵
        
        PID:8340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26779.exe
        6⤵
        
        PID:12880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20362.exe
        6⤵
        
        PID:17744
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 17744 -s 280
        7⤵
        Program crash
        
        PID:18348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65309.exe
        6⤵
        
        PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        5⤵
        
        PID:3816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33901.exe
        6⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21991.exe
        7⤵
        
        PID:9640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64158.exe
        7⤵
        
        PID:12592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3076.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7907.exe
        7⤵
        
        PID:17960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1569.exe
        6⤵
        
        PID:9568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63499.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33409.exe
        5⤵
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32743.exe
        6⤵
        
        PID:8832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52798.exe
        6⤵
        
        PID:11992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57650.exe
        6⤵
        
        PID:15244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28660.exe
        6⤵
        
        PID:18068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58523.exe
        5⤵
        
        PID:9240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2115.exe
        5⤵
        
        PID:12636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2140.exe
        5⤵
        
        PID:16404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22683.exe
        5⤵
        
        PID:18168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54894.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59508.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25972.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9651.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28967.exe
        8⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60814.exe
        9⤵
        
        PID:8024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7428.exe
        9⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2669.exe
        9⤵
        
        PID:15260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        9⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        8⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50277.exe
        8⤵
        
        PID:8812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10925.exe
        8⤵
        
        PID:13844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48013.exe
        8⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42650.exe
        7⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9382.exe
        8⤵
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29879.exe
        9⤵
        
        PID:9876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34282.exe
        9⤵
        
        PID:13344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35557.exe
        9⤵
        
        PID:17584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57684.exe
        9⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56526.exe
        8⤵
        
        PID:10184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8324.exe
        8⤵
        
        PID:13384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        8⤵
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8161.exe
        7⤵
        
        PID:7792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17133.exe
        7⤵
        
        PID:10580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34465.exe
        7⤵
        
        PID:14732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63373.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25530.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29652.exe
        7⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44276.exe
        8⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39997.exe
        8⤵
        
        PID:8224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41189.exe
        8⤵
        
        PID:13868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        8⤵
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43819.exe
        7⤵
        
        PID:7716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30782.exe
        7⤵
        
        PID:8376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62146.exe
        7⤵
        
        PID:15628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23521.exe
        6⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21709.exe
        7⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19732.exe
        8⤵
        
        PID:13052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59102.exe
        8⤵
        
        PID:17084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31665.exe
        7⤵
        
        PID:9752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20157.exe
        7⤵
        
        PID:15760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14026.exe
        6⤵
        
        PID:7752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8660.exe
        6⤵
        
        PID:10528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17930.exe
        6⤵
        
        PID:14756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21147.exe
        6⤵
        
        PID:2544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38970.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44244.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64052.exe
        7⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60311.exe
        8⤵
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12141.exe
        8⤵
        
        PID:10428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48885.exe
        8⤵
        
        PID:14504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28366.exe
        8⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30947.exe
        8⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59195.exe
        7⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7428.exe
        7⤵
        
        PID:10760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4122.exe
        7⤵
        
        PID:14880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59646.exe
        6⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13139.exe
        7⤵
        
        PID:7428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33527.exe
        8⤵
        
        PID:10016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59275.exe
        8⤵
        
        PID:13696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64773.exe
        8⤵
        
        PID:18060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48552.exe
        8⤵
        
        PID:16740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13101.exe
        7⤵
        
        PID:10304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26580.exe
        7⤵
        
        PID:14388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28366.exe
        7⤵
        
        PID:16880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        7⤵
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42754.exe
        6⤵
        
        PID:7996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18231.exe
        7⤵
        
        PID:17068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54420.exe
        7⤵
        
        PID:16556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13293.exe
        6⤵
        
        PID:10272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60994.exe
        6⤵
        
        PID:14720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48013.exe
        6⤵
        
        PID:2464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20516.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30119.exe
        6⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21709.exe
        7⤵
        
        PID:7632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28932.exe
        8⤵
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42992.exe
        8⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31665.exe
        7⤵
        
        PID:11088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20157.exe
        7⤵
        
        PID:15744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30947.exe
        7⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59195.exe
        6⤵
        
        PID:7920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7428.exe
        6⤵
        
        PID:10468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2669.exe
        6⤵
        
        PID:15392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13325.exe
        5⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63300.exe
        6⤵
        
        PID:7848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64231.exe
        7⤵
        
        PID:14048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56148.exe
        7⤵
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64139.exe
        6⤵
        
        PID:10632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35813.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49011.exe
        6⤵
        
        PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64357.exe
        5⤵
        
        PID:7480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42743.exe
        5⤵
        
        PID:13008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49036.exe
        5⤵
        
        PID:17248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38443.exe
        5⤵
        
        PID:5940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36850.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58452.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12806.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-902.exe
        7⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2877.exe
        8⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8881.exe
        8⤵
        
        PID:10456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20157.exe
        8⤵
        
        PID:15752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30947.exe
        8⤵
        
        PID:384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43819.exe
        7⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11460.exe
        7⤵
        
        PID:10544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43131.exe
        7⤵
        
        PID:14744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49082.exe
        7⤵
        
        PID:3900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46875.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29284.exe
        7⤵
        
        PID:7456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45390.exe
        7⤵
        
        PID:10356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-68.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-68.exe
        7⤵
        
        PID:14584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27598.exe
        7⤵
        
        PID:17676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54866.exe
        6⤵
        
        PID:7680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17709.exe
        6⤵
        
        PID:10460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46085.exe
        6⤵
        
        PID:14488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3165.exe
        6⤵
        
        PID:17516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58971.exe
        5⤵
        
        PID:4116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33901.exe
        6⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18279.exe
        7⤵
        
        PID:12920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60062.exe
        7⤵
        
        PID:16980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2618.exe
        7⤵
        
        PID:18436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52882.exe
        6⤵
        
        PID:6824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64350.exe
        6⤵
        
        PID:10820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20852.exe
        6⤵
        
        PID:2140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47821.exe
        6⤵
        
        PID:2808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59474.exe
        5⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12774.exe
        6⤵
        
        PID:9944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16301.exe
        6⤵
        
        PID:13400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20564.exe
        6⤵
        
        PID:17564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8483.exe
        6⤵
        
        PID:18460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38462.exe
        5⤵
        
        PID:10172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3521.exe
        5⤵
        
        PID:13796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44970.exe
        5⤵
        
        PID:17856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27551.exe
        5⤵
        
        PID:2672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41851.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12806.exe
        5⤵
        Executes dropped EXE
        
        PID:4792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14742.exe
        6⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21709.exe
        7⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31665.exe
        7⤵
        
        PID:10704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20157.exe
        7⤵
        
        PID:15768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        7⤵
        
        PID:1856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe
        6⤵
        
        PID:7760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39141.exe
        6⤵
        
        PID:11648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61182.exe
        6⤵
        
        PID:16668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49549.exe
        6⤵
        
        PID:18224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62334.exe
        5⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21709.exe
        6⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7126.exe
        7⤵
        
        PID:11968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43915.exe
        7⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56728.exe
        7⤵
        
        PID:18080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31665.exe
        6⤵
        
        PID:10656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20157.exe
        6⤵
        
        PID:15784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        6⤵
        
        PID:3516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57170.exe
        5⤵
        
        PID:7852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18202.exe
        5⤵
        
        PID:10612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33012.exe
        5⤵
        
        PID:14856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44546.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36164.exe
      4⤵
      PID:4236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33901.exe
        5⤵
        
        PID:6588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17044.exe
        6⤵
        
        PID:11368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1245.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19633.exe
        5⤵
        
        PID:9840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15642.exe
        5⤵
        
        PID:14260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44293.exe
        5⤵
        
        PID:18128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48013.exe
        5⤵
        
        PID:18268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40989.exe
      4⤵
      PID:6300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49460.exe
      4⤵
      PID:7556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33148.exe
      4⤵
      PID:14128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19109.exe
      4⤵
      PID:18176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63148.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3482.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3482.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42580.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44747.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12422.exe
        6⤵
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7747.exe
        7⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25348.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18205.exe
        8⤵
        
        PID:11608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39202.exe
        8⤵
        
        PID:16228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14435.exe
        8⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22794.exe
        7⤵
        
        PID:8356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10529.exe
        7⤵
        
        PID:12164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22299.exe
        7⤵
        
        PID:16516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65355.exe
        7⤵
        
        PID:64
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46590.exe
        6⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
        7⤵
        
        PID:11180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42741.exe
        7⤵
        
        PID:14580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10.exe
        7⤵
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2721.exe
        6⤵
        
        PID:8780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46670.exe
        6⤵
        
        PID:13968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        6⤵
        
        PID:17984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49082.exe
        6⤵
        
        PID:17924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40911.exe
        5⤵
        
        PID:4696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41188.exe
        6⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46775.exe
        7⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18205.exe
        7⤵
        
        PID:11496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39202.exe
        7⤵
        
        PID:16204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20195.exe
        7⤵
        
        PID:17852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8954.exe
        6⤵
        
        PID:8440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8692.exe
        6⤵
        
        PID:12388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5386.exe
        6⤵
        
        PID:16760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19994.exe
        6⤵
        
        PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65339.exe
        5⤵
        
        PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29796.exe
        5⤵
        
        PID:10160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52523.exe
        5⤵
        
        PID:13804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61268.exe
        5⤵
        
        PID:18072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22216.exe
        5⤵
        
        PID:18260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43482.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2147.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21956.exe
        6⤵
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18215.exe
        7⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41159.exe
        8⤵
        
        PID:13188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59102.exe
        8⤵
        
        PID:17332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37994.exe
        7⤵
        
        PID:8968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40421.exe
        7⤵
        
        PID:14324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30947.exe
        7⤵
        
        PID:16224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64270.exe
        6⤵
        
        PID:6728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16836.exe
        6⤵
        
        PID:9512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34849.exe
        6⤵
        
        PID:15192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29501.exe
        6⤵
        
        PID:1832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62813.exe
        6⤵
        
        PID:14484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18234.exe
        5⤵
        
        PID:3156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18983.exe
        6⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18279.exe
        7⤵
        
        PID:12856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60062.exe
        7⤵
        
        PID:17020
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 17020 -s 428
        8⤵
        Program crash
        
        PID:4740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54990.exe
        6⤵
        
        PID:9756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39653.exe
        6⤵
        
        PID:13420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54110.exe
        6⤵
        
        PID:18220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56620.exe
        5⤵
        
        PID:5924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11658.exe
        5⤵
        
        PID:10136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5524.exe
        5⤵
        
        PID:13356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26482.exe
        5⤵
        
        PID:2604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12161.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5043.exe
        5⤵
        
        PID:4880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1302.exe
        6⤵
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53070.exe
        6⤵
        
        PID:8428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59358.exe
        6⤵
        
        PID:15092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46037.exe
        6⤵
        
        PID:18080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45747.exe
        6⤵
        
        PID:18412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48510.exe
        5⤵
        
        PID:6488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49893.exe
        5⤵
        
        PID:9448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34849.exe
        5⤵
        
        PID:15200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29501.exe
        5⤵
        
        PID:18112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62813.exe
        5⤵
        
        PID:18400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7658.exe
      4⤵
      PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20052.exe
        5⤵
        
        PID:6592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
        6⤵
        
        PID:11192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20052.exe
        6⤵
        
        PID:15296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62283.exe
        6⤵
        
        PID:18156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36157.exe
        5⤵
        
        PID:9384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57634.exe
        5⤵
        
        PID:14220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30947.exe
        5⤵
        
        PID:16860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20545.exe
      4⤵
      PID:7400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
        5⤵
        
        PID:9956
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9956 -s 472
        6⤵
        Program crash
        
        PID:1792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60126.exe
        5⤵
        
        PID:14268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47483.exe
        5⤵
        
        PID:3720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56126.exe
      4⤵
      PID:10332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63335.exe
      4⤵
      PID:14472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64237.exe
      4⤵
      PID:17388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25155.exe
      4⤵
      PID:17992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36450.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36450.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10774.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51156.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20503.exe
        6⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17063.exe
        7⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51051.exe
        8⤵
        
        PID:9452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5921.exe
        8⤵
        
        PID:13184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33726.exe
        8⤵
        
        PID:17216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65355.exe
        8⤵
        
        PID:17492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48747.exe
        7⤵
        
        PID:8740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61157.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14125.exe
        7⤵
        
        PID:17036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64779.exe
        7⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32666.exe
        6⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34196.exe
        7⤵
        
        PID:8752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21002.exe
        7⤵
        
        PID:11948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57650.exe
        7⤵
        
        PID:14688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44612.exe
        7⤵
        
        PID:3208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22772.exe
        6⤵
        
        PID:8628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18781.exe
        6⤵
        
        PID:12500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38517.exe
        6⤵
        
        PID:17156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32483.exe
        6⤵
        
        PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20922.exe
        5⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12490.exe
        6⤵
        
        PID:8052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21844.exe
        6⤵
        
        PID:10424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16701.exe
        6⤵
        
        PID:15100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        6⤵
        
        PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12468.exe
        5⤵
        
        PID:6760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16999.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59275.exe
        6⤵
        
        PID:13716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64773.exe
        6⤵
        
        PID:18052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48552.exe
        6⤵
        
        PID:2268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59515.exe
        5⤵
        
        PID:9596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36852.exe
        5⤵
        
        PID:13412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28909.exe
        5⤵
        
        PID:18228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27551.exe
        5⤵
        
        PID:4224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63771.exe
      4⤵
      Executes dropped EXE
      PID:4984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60693.exe
      4⤵
      PID:3144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23975.exe
        5⤵
        
        PID:5484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14979.exe
        6⤵
        
        PID:8260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18205.exe
        6⤵
        
        PID:11584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23441.exe
        6⤵
        
        PID:16008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24029.exe
        5⤵
        
        PID:8464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41941.exe
        5⤵
        
        PID:11416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21229.exe
        5⤵
        
        PID:16476
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16476 -s 464
        6⤵
        Program crash
        
        PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63912.exe
        5⤵
        
        PID:7124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27166.exe
      4⤵
      PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8134.exe
        5⤵
        
        PID:8012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18205.exe
        5⤵
        
        PID:11616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39202.exe
        5⤵
        
        PID:16220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48552.exe
        5⤵
        
        PID:3580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17585.exe
      4⤵
      PID:8216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56731.exe
      4⤵
      PID:11672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62788.exe
      4⤵
      PID:16712
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16712 -s 464
        5⤵
        Program crash
        
        PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59154.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59154.exe
      4⤵
      PID:2956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29726.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29726.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32324.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2547.exe
        5⤵
        
        PID:2184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7747.exe
        6⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36884.exe
        7⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44923.exe
        7⤵
        
        PID:10264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64261.exe
        7⤵
        
        PID:15588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48552.exe
        7⤵
        
        PID:4784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26333.exe
        6⤵
        
        PID:8308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31940.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60142.exe
        6⤵
        
        PID:16108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45739.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33127.exe
        6⤵
        
        PID:8784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21002.exe
        6⤵
        
        PID:11956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56581.exe
        6⤵
        
        PID:14908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61332.exe
        6⤵
        
        PID:316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12020.exe
        5⤵
        
        PID:8924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58491.exe
        5⤵
        
        PID:13232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20836.exe
        5⤵
        
        PID:17132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31306.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31306.exe
      4⤵
      PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9366.exe
        5⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24279.exe
        6⤵
        
        PID:8124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18205.exe
        6⤵
        
        PID:11592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39202.exe
        6⤵
        
        PID:16156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32196.exe
        5⤵
        
        PID:9620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28014.exe
        5⤵
        
        PID:13272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33908.exe
        5⤵
        
        PID:3752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32483.exe
        5⤵
        
        PID:1388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63314.exe
      4⤵
      PID:6528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9763.exe
        5⤵
        
        PID:14980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57684.exe
        5⤵
        
        PID:9416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55758.exe
      4⤵
      PID:9460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18314.exe
      4⤵
      PID:15180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46567.exe
      4⤵
      PID:2444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42610.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42610.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5619.exe
      4⤵
      PID:1796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51079.exe
        5⤵
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21351.exe
        6⤵
        
        PID:11772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24013.exe
        6⤵
        
        PID:16276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7034.exe
        6⤵
        
        PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2826.exe
        5⤵
        
        PID:10204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38117.exe
        5⤵
        
        PID:13784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5101.exe
        5⤵
        
        PID:18044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        5⤵
        
        PID:4756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64270.exe
      4⤵
      PID:6968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3587.exe
        5⤵
        
        PID:12700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27581.exe
        5⤵
        
        PID:17288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36053.exe
      4⤵
      PID:9776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45518.exe
      4⤵
      PID:13660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45445.exe
      4⤵
      PID:18212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49082.exe
      4⤵
      PID:4228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45498.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45498.exe
    3⤵
    PID:3964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43826.exe
      4⤵
      PID:8408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19383.exe
        5⤵
        
        PID:16464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51908.exe
        5⤵
        
        PID:6616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25684.exe
      4⤵
      PID:12804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54462.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:17052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65309.exe
      4⤵
      PID:5980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59975.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59975.exe
    3⤵
    PID:6472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32743.exe
      4⤵
      PID:8840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21002.exe
      4⤵
      PID:11976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57650.exe
      4⤵
      PID:3388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48552.exe
      4⤵
      PID:2372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54057.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54057.exe
    3⤵
    PID:9268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56546.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56546.exe
    3⤵
    PID:13020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33978.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33978.exe
    3⤵
    PID:17096
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22781.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22781.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39876.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39876.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42580.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44747.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62308.exe
        6⤵
        
        PID:1328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25428.exe
        7⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23044.exe
        8⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11181.exe
        8⤵
        
        PID:9772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64946.exe
        8⤵
        
        PID:15656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47483.exe
        8⤵
        
        PID:16900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26333.exe
        7⤵
        
        PID:8320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-529.exe
        7⤵
        
        PID:11472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45067.exe
        7⤵
        
        PID:16136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14218.exe
        7⤵
        
        PID:4944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38426.exe
        6⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21207.exe
        7⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59998.exe
        7⤵
        
        PID:8960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64261.exe
        7⤵
        
        PID:15572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48552.exe
        7⤵
        
        PID:2820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36130.exe
        6⤵
        
        PID:7840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35502.exe
        6⤵
        
        PID:11392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20641.exe
        6⤵
        
        PID:15988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22099.exe
        6⤵
        
        PID:18100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62827.exe
        5⤵
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21709.exe
        6⤵
        
        PID:7948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31665.exe
        6⤵
        
        PID:10720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20157.exe
        6⤵
        
        PID:15724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4593.exe
        5⤵
        
        PID:7928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7636.exe
        5⤵
        
        PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61524.exe
        5⤵
        
        PID:14912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22216.exe
        5⤵
        
        PID:2192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43482.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18100.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7731.exe
        6⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19284.exe
        7⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2826.exe
        7⤵
        
        PID:10228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40805.exe
        7⤵
        
        PID:13944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5101.exe
        7⤵
        
        PID:17996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30947.exe
        7⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48811.exe
        6⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3587.exe
        7⤵
        
        PID:12716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28650.exe
        7⤵
        
        PID:16952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34522.exe
        7⤵
        
        PID:1172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3188.exe
        6⤵
        
        PID:9732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13037.exe
        6⤵
        
        PID:14252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48013.exe
        6⤵
        
        PID:16804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4394.exe
        5⤵
        
        PID:5356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21012.exe
        6⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32855.exe
        7⤵
        
        PID:17868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42499.exe
        7⤵
        
        PID:3084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7325.exe
        6⤵
        
        PID:10052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58786.exe
        6⤵
        
        PID:14196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52958.exe
        6⤵
        
        PID:18144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        6⤵
        
        PID:9336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6241.exe
        5⤵
        
        PID:7600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31140.exe
        6⤵
        
        PID:9844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33898.exe
        6⤵
        
        PID:13388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20564.exe
        6⤵
        
        PID:17556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59598.exe
        5⤵
        
        PID:9252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38389.exe
        5⤵
        
        PID:13456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2282.exe
      4⤵
      PID:1424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25511.exe
        5⤵
        
        PID:6120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15181.exe
        6⤵
        
        PID:8944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50436.exe
        7⤵
        
        PID:17092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53844.exe
        7⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35506.exe
        6⤵
        
        PID:11300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54395.exe
        6⤵
        
        PID:16084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12506.exe
        6⤵
        
        PID:17752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62270.exe
        5⤵
        
        PID:8796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34737.exe
        5⤵
        
        PID:12104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61486.exe
        5⤵
        
        PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29402.exe
        5⤵
        
        PID:1108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55605.exe
      4⤵
      PID:5396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46199.exe
        5⤵
        
        PID:8300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52331.exe
        5⤵
        
        PID:11536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23441.exe
        5⤵
        
        PID:15960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22308.exe
        5⤵
        
        PID:15712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16125.exe
      4⤵
      PID:1332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8259.exe
      4⤵
      PID:11752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56716.exe
      4⤵
      PID:16652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39019.exe
      4⤵
      PID:5552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6378.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6378.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60167.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18676.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20036.exe
        6⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1146.exe
        7⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35415.exe
        8⤵
        
        PID:15456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50091.exe
        8⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21060.exe
        7⤵
        
        PID:10032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54750.exe
        7⤵
        
        PID:14528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19700.exe
        7⤵
        
        PID:17528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49082.exe
        7⤵
        
        PID:4536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45739.exe
        6⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19703.exe
        7⤵
        
        PID:10932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54750.exe
        7⤵
        
        PID:14932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14906.exe
        7⤵
        
        PID:18016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57300.exe
        7⤵
        
        PID:18504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32596.exe
        6⤵
        
        PID:10152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12186.exe
        6⤵
        
        PID:13756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61506.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48013.exe
        6⤵
        
        PID:1832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51867.exe
        5⤵
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51079.exe
        6⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24740.exe
        7⤵
        
        PID:12456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7217.exe
        7⤵
        
        PID:17700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57684.exe
        7⤵
        
        PID:5620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2826.exe
        6⤵
        
        PID:10212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7748.exe
        6⤵
        
        PID:14140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54110.exe
        6⤵
        
        PID:18188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30947.exe
        6⤵
        
        PID:5516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12468.exe
        5⤵
        
        PID:6740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22702.exe
        5⤵
        
        PID:9496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54834.exe
        5⤵
        
        PID:14280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28909.exe
        5⤵
        
        PID:18200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26482.exe
        5⤵
        
        PID:8188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64155.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5811.exe
        5⤵
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43826.exe
        6⤵
        
        PID:8384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25684.exe
        6⤵
        
        PID:12796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54462.exe
        6⤵
        
        PID:17012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48510.exe
        5⤵
        
        PID:6496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26215.exe
        6⤵
        
        PID:9164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9949.exe
        6⤵
        
        PID:11984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1162.exe
        6⤵
        
        PID:15088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49019.exe
        6⤵
        
        PID:18144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        5⤵
        
        PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26779.exe
        5⤵
        
        PID:12916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7188.exe
        5⤵
        
        PID:17184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32483.exe
        5⤵
        
        PID:2892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16209.exe
      4⤵
      PID:3572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1302.exe
        5⤵
        
        PID:6188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33127.exe
        6⤵
        
        PID:8880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2902.exe
        7⤵
        
        PID:12728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27581.exe
        7⤵
        
        PID:16968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51819.exe
        7⤵
        
        PID:17572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37805.exe
        6⤵
        
        PID:12212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15665.exe
        6⤵
        
        PID:15176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22308.exe
        6⤵
        
        PID:17892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63822.exe
        5⤵
        
        PID:8820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48357.exe
        5⤵
        
        PID:9076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61195.exe
        5⤵
        
        PID:13892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        5⤵
        
        PID:18004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48013.exe
        5⤵
        
        PID:18392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2573.exe
      4⤵
      PID:6480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3587.exe
        5⤵
        
        PID:12772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27581.exe
        5⤵
        
        PID:17280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51819.exe
        5⤵
        
        PID:3828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47093.exe
      4⤵
      PID:9360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38298.exe
      4⤵
      PID:14208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45975.exe
      4⤵
      PID:18240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21147.exe
      4⤵
      PID:16724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38386.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38386.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15796.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2054.exe
        5⤵
        
        PID:4928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56839.exe
        6⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8134.exe
        7⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18205.exe
        7⤵
        
        PID:11576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39202.exe
        7⤵
        
        PID:16124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48552.exe
        7⤵
        
        PID:17916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5581.exe
        6⤵
        
        PID:7636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25988.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22299.exe
        6⤵
        
        PID:16524
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16524 -s 416
        7⤵
        Program crash
        
        PID:18356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38810.exe
        5⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58404.exe
        6⤵
        
        PID:7872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15901.exe
        6⤵
        
        PID:11332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23441.exe
        6⤵
        
        PID:15980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14435.exe
        6⤵
        
        PID:18264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3172.exe
        5⤵
        
        PID:8140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31854.exe
        5⤵
        
        PID:11340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12180.exe
        5⤵
        
        PID:16636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49011.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15162.exe
      4⤵
      PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2490.exe
        5⤵
        
        PID:6988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9686.exe
        6⤵
        
        PID:9200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9949.exe
        6⤵
        
        PID:12100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1162.exe
        6⤵
        
        PID:17400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65355.exe
        6⤵
        
        PID:18512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8081.exe
        5⤵
        
        PID:8632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3706.exe
        5⤵
        
        PID:12524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17089.exe
        5⤵
        
        PID:16868
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16868 -s 464
        6⤵
        Program crash
        
        PID:16376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15187.exe
        5⤵
        
        PID:404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52930.exe
      4⤵
      PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38119.exe
        5⤵
        
        PID:6568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11181.exe
        5⤵
        
        PID:8956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64946.exe
        5⤵
        
        PID:15640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47291.exe
        5⤵
        
        PID:804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45934.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45934.exe
      4⤵
      PID:8288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29140.exe
      4⤵
      PID:11544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19866.exe
      4⤵
      PID:16188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18410.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18410.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20036.exe
      4⤵
      PID:916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59252.exe
        5⤵
        
        PID:6072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36884.exe
        6⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51911.exe
        7⤵
        
        PID:12540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28650.exe
        7⤵
        
        PID:17060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2618.exe
        7⤵
        
        PID:6056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9261.exe
        6⤵
        
        PID:10564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45813.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48552.exe
        6⤵
        
        PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53422.exe
        5⤵
        
        PID:7536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31940.exe
        5⤵
        
        PID:11640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29307.exe
        5⤵
        
        PID:16000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53435.exe
        5⤵
        
        PID:2308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48043.exe
      4⤵
      PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33127.exe
        5⤵
        
        PID:8856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
        6⤵
        
        PID:11208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20052.exe
        6⤵
        
        PID:15304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62494.exe
        5⤵
        
        PID:10892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3140.exe
        5⤵
        
        PID:14780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44382.exe
        5⤵
        
        PID:16176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5770.exe
        5⤵
        
        PID:16692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8081.exe
      4⤵
      PID:8500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3706.exe
      4⤵
      PID:12508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48885.exe
      4⤵
      PID:16856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61892.exe
      4⤵
      PID:4500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13793.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13793.exe
    3⤵
    PID:2932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61883.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3587.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27581.exe
        5⤵
        
        PID:16932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2042.exe
        5⤵
        
        PID:18176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7428.exe
      4⤵
      PID:10640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4122.exe
      4⤵
      PID:15188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30947.exe
      4⤵
      PID:1544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58670.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58670.exe
    3⤵
    PID:6720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35191.exe
      4⤵
      PID:12556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28650.exe
      4⤵
      PID:16960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2618.exe
      4⤵
      PID:18444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14566.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14566.exe
    3⤵
    PID:9532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33833.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33833.exe
    3⤵
    PID:14188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63148.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63148.exe
    3⤵
    PID:1376
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33745.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33745.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9715.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9715.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31060.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18484.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6003.exe
        6⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51463.exe
        7⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37959.exe
        8⤵
        
        PID:9556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43899.exe
        8⤵
        
        PID:14228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47483.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39914.exe
        7⤵
        
        PID:9616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39653.exe
        7⤵
        
        PID:13740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28058.exe
        7⤵
        
        PID:18388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1146.exe
        6⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18279.exe
        7⤵
        
        PID:12948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60062.exe
        7⤵
        
        PID:16988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21060.exe
        6⤵
        
        PID:10416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54750.exe
        6⤵
        
        PID:14516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19700.exe
        6⤵
        
        PID:9376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49082.exe
        6⤵
        
        PID:15824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51483.exe
        5⤵
        
        PID:1132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43826.exe
        6⤵
        
        PID:8400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37806.exe
        6⤵
        
        PID:11552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20641.exe
        6⤵
        
        PID:15972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3459.exe
        6⤵
        
        PID:16764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47170.exe
        5⤵
        
        PID:6420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35047.exe
        6⤵
        
        PID:8972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54635.exe
        6⤵
        
        PID:12264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15665.exe
        6⤵
        
        PID:16196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39028.exe
        6⤵
        
        PID:17904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2509.exe
        5⤵
        
        PID:8424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18113.exe
        5⤵
        
        PID:12840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4301.exe
        5⤵
        
        PID:17124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62813.exe
        5⤵
        
        PID:17676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15146.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5043.exe
        5⤵
        
        PID:3788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20820.exe
        6⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26215.exe
        7⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9949.exe
        7⤵
        
        PID:11876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1162.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49019.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48747.exe
        6⤵
        
        PID:8816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62226.exe
        6⤵
        
        PID:12908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14125.exe
        6⤵
        
        PID:17000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31597.exe
        5⤵
        
        PID:6780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18663.exe
        6⤵
        
        PID:13044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59102.exe
        6⤵
        
        PID:17352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51819.exe
        6⤵
        
        PID:17444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53650.exe
        5⤵
        
        PID:9680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23796.exe
        5⤵
        
        PID:14376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62813.exe
        5⤵
        
        PID:18416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1793.exe
      4⤵
      PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52340.exe
        5⤵
        
        PID:6680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5379.exe
        6⤵
        
        PID:9500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57723.exe
        6⤵
        
        PID:13252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27860.exe
        6⤵
        
        PID:17080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8483.exe
        6⤵
        
        PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35690.exe
        5⤵
        
        PID:9108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56949.exe
        5⤵
        
        PID:14068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5101.exe
        5⤵
        
        PID:18032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        5⤵
        
        PID:4304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37083.exe
      4⤵
      PID:6820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33127.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21002.exe
        5⤵
        
        PID:11940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56581.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48552.exe
        5⤵
        
        PID:16200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25940.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59803.exe
      4⤵
      PID:12652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40116.exe
      4⤵
      PID:17072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26290.exe
      4⤵
      PID:17936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59134.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59134.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32074.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32074.exe
      4⤵
      PID:2152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7747.exe
        5⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25348.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18205.exe
        6⤵
        
        PID:11624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39202.exe
        6⤵
        
        PID:16164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38836.exe
        6⤵
        
        PID:2840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22794.exe
        5⤵
        
        PID:8284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10529.exe
        5⤵
        
        PID:12184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22299.exe
        5⤵
        
        PID:16500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52283.exe
        5⤵
        
        PID:2424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60325.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26039.exe
        5⤵
        
        PID:10248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46971.exe
        5⤵
        
        PID:13416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65349.exe
        5⤵
        
        PID:18360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57595.exe
      4⤵
      PID:9352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38690.exe
      4⤵
      PID:14308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45245.exe
      4⤵
      PID:18152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26482.exe
      4⤵
      PID:1244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11777.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11777.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40788.exe
      4⤵
      PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64535.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-454.exe
        6⤵
        
        PID:8760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21002.exe
        6⤵
        
        PID:11932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57650.exe
        6⤵
        
        PID:15312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6656.exe
        6⤵
        
        PID:852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64891.exe
        5⤵
        
        PID:8980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52626.exe
        5⤵
        
        PID:13124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13165.exe
        5⤵
        
        PID:17224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65355.exe
        5⤵
        
        PID:18468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57253.exe
      4⤵
      PID:8076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32837.exe
      4⤵
      PID:9940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60994.exe
      4⤵
      PID:15384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23995.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23995.exe
    3⤵
    PID:5368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43826.exe
      4⤵
      PID:8392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25684.exe
      4⤵
      PID:12812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54462.exe
      4⤵
      PID:17028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-348.exe
      4⤵
      PID:18480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10052.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10052.exe
    3⤵
    PID:6572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42359.exe
      4⤵
      PID:9184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9949.exe
      4⤵
      PID:11928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50066.exe
      4⤵
      PID:16552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21555.exe
      4⤵
      PID:17596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61294.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61294.exe
    3⤵
    PID:9344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-278.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-278.exe
    3⤵
    PID:12140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35113.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35113.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:17116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22683.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22683.exe
    3⤵
    PID:17668
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42315.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42315.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47204.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47204.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1763.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7731.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18983.exe
        6⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26215.exe
        7⤵
        
        PID:9172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9949.exe
        7⤵
        
        PID:12008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1162.exe
        7⤵
        
        PID:17260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49019.exe
        7⤵
        
        PID:17376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47678.exe
        6⤵
        
        PID:8720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54350.exe
        6⤵
        
        PID:13444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17764.exe
        6⤵
        
        PID:17540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32483.exe
        6⤵
        
        PID:18060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42884.exe
        5⤵
        
        PID:6800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
        6⤵
        
        PID:11216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20052.exe
        6⤵
        
        PID:15280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39435.exe
        6⤵
        
        PID:18208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5793.exe
        5⤵
        
        PID:10144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14189.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48013.exe
        5⤵
        
        PID:2408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20538.exe
      4⤵
      PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19284.exe
        5⤵
        
        PID:4548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6998.exe
        6⤵
        
        PID:9588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8413.exe
        6⤵
        
        PID:13136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36709.exe
        6⤵
        
        PID:2340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57684.exe
        6⤵
        
        PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2826.exe
        5⤵
        
        PID:10220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59358.exe
        5⤵
        
        PID:15116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46037.exe
        5⤵
        
        PID:17980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53147.exe
      4⤵
      PID:6512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4628.exe
      4⤵
      PID:8712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43005.exe
      4⤵
      PID:14968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27551.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63579.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63579.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7539.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3907.exe
        5⤵
        
        PID:6536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32695.exe
        6⤵
        
        PID:12604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27581.exe
        6⤵
        
        PID:17296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2042.exe
        6⤵
        
        PID:18116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3972.exe
        5⤵
        
        PID:9192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64942.exe
        5⤵
        
        PID:620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49011.exe
        5⤵
        
        PID:5512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48811.exe
      4⤵
      PID:6920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29287.exe
        5⤵
        
        PID:8596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49643.exe
        5⤵
        
        PID:12492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51685.exe
        5⤵
        
        PID:16848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
      4⤵
      PID:8436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34999.exe
        5⤵
        
        PID:12640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28650.exe
        5⤵
        
        PID:16944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65083.exe
        5⤵
        
        PID:18368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4673.exe
      4⤵
      PID:13728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45437.exe
      4⤵
      PID:18016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26482.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34273.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34273.exe
    3⤵
    PID:5448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-918.exe
      4⤵
      PID:6292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26215.exe
        5⤵
        
        PID:9156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9949.exe
        5⤵
        
        PID:11824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48146.exe
        5⤵
        
        PID:16292
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16292 -s 464
        6⤵
        Program crash
        
        PID:9416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47483.exe
        5⤵
        
        PID:16908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48830.exe
      4⤵
      PID:7992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4769.exe
      4⤵
      PID:12780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15853.exe
      4⤵
      PID:17172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65355.exe
      4⤵
      PID:18452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52459.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52459.exe
    3⤵
    PID:6556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33127.exe
      4⤵
      PID:8872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37805.exe
      4⤵
      PID:12200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15665.exe
      4⤵
      PID:16376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62593.exe
      4⤵
      PID:2988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9220.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9220.exe
    3⤵
    PID:8848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33290.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33290.exe
    3⤵
    PID:13140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5030.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5030.exe
    3⤵
    PID:17268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28018.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28018.exe
    3⤵
    PID:17524
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54418.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54418.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32458.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32458.exe
    3⤵
    PID:3264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1146.exe
      4⤵
      PID:6672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37959.exe
        5⤵
        
        PID:8560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40525.exe
        5⤵
        
        PID:13872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13268.exe
        5⤵
        
        PID:18084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47483.exe
        5⤵
        
        PID:5316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21060.exe
      4⤵
      PID:9760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14189.exe
      4⤵
      PID:14248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48013.exe
      4⤵
      PID:14848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44866.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44866.exe
    3⤵
    PID:6240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33127.exe
      4⤵
      PID:8864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
        5⤵
        
        PID:11172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20052.exe
        5⤵
        
        PID:15288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37982.exe
        5⤵
        
        PID:18264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12890.exe
        5⤵
        
        PID:9388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
      4⤵
      PID:10732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35813.exe
      4⤵
      PID:14832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48552.exe
      4⤵
      PID:5004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1741.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1741.exe
    3⤵
    PID:8724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58357.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58357.exe
    3⤵
    PID:12868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54462.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54462.exe
    3⤵
    PID:17044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49549.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49549.exe
    3⤵
    PID:18088
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25690.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25690.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24260.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24260.exe
    3⤵
    PID:5380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41597.exe
      4⤵
      PID:7980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46437.exe
      4⤵
      PID:10944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41678.exe
      4⤵
      PID:14868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56981.exe
      4⤵
      PID:2652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62260.exe
      4⤵
      PID:6116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58706.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58706.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13293.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13293.exe
    3⤵
    PID:10348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60994.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60994.exe
    3⤵
    PID:14740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49082.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49082.exe
    3⤵
    PID:2976
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32004.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32004.exe
  2⤵
  PID:5476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52340.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52340.exe
    3⤵
    PID:6688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
      4⤵
      PID:11248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20052.exe
      4⤵
      PID:15340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37982.exe
      4⤵
      PID:18276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12890.exe
      4⤵
      PID:15968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36837.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36837.exe
    3⤵
    PID:9476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64942.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64942.exe
    3⤵
    PID:14404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
    3⤵
    PID:3968
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25097.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25097.exe
  2⤵
  PID:6948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
    3⤵
    PID:11200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20052.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20052.exe
    3⤵
    PID:15316
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39589.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39589.exe
  2⤵
  PID:9740
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14717.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14717.exe
  2⤵
  PID:13440
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61110.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61110.exe
  2⤵
  PID:18164
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61417.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61417.exe
  2⤵
  PID:4760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 9956 -ip 9956
1⤵
PID:11168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 14828 -ip 14828
1⤵
PID:18416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4496 -ip 4496
1⤵
PID:17428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 16200 -ip 16200
1⤵
PID:2144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 16508 -ip 16508
1⤵
PID:1068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 17072 -ip 17072
1⤵
PID:16240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 16612 -ip 16612
1⤵
PID:1064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 16848 -ip 16848
1⤵
PID:17976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 16636 -ip 16636
1⤵
PID:18140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 16980 -ip 16980
1⤵
PID:13604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
- Suspicious behavior: AddClipboardFormatListener
PID:15944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-10774.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-10774.exe
Size 468KB
SHA256 8dd73df1e907efbced5ed3260c6bd19a352383bf1faecab38364a1e96f6d68fb
MD5 b41b7d73f8ed24acbbe99f573c82f663
SHA1 f95dcaeda1b6fb3ddde4651ba830486a4cee4602
SHA512 6a073a3d5f9d47e865d5620e69d13cae7b6a9ecb577e2bab80f179a2313bec11533a270de416d4d237d378cc1b358fbebd5ad12fb2ee0e4914407099dbd5c0e0
SSDEEP 3072:SO0sogllIV5jtbY94AcTJf8w4ChCSppqJEHCxFWwJHLLQAqughlf:SO/oJjjtS4dTJfhfY3JHPhqug
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-19383.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-19383.exe
Size 468KB
SHA256 78348794fc89d5e7b52cf3135680007937434e11053dde9c5047f7007f451981
MD5 773cdebfb2d3742f7fb3ff8650efd845
SHA1 3f4231e4e4e258e8af62d3e254827132dfb9b480
SHA512 5fd3c81c63f7caef50d035aa5cdfbe81c9dfcb73e9d5604bff3cf2436d3fbc0d414a1e9742938f04f58f9026c7cd6eb60d6ea48f1a6a3fed40b5abc4b7aa3c6d
SSDEEP 3072:FO0soglEIV5jtbY94AcTJf8w4ChCSBpLJEHCxFWVJeLLQAuughlf:FO/o0jjtS4dTJfhnxqJePhuug
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-22781.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-22781.exe
Size 468KB
SHA256 e12ef2d02443a033638fc88cf4fce5c310394f56e0ee815b1b4c0843c8ff28f7
MD5 180dceedba5b0881ed040a095a41906d
SHA1 a0e84a9f67c4292aea9f35617c1562ffaf915347
SHA512 01558378daec65d008b7951ab99d9d85a8c97deb4b022ac77e593942ff27a159232c1841986709b73111eeb57775f3a7093e575d0480799f63e13b0d03acbcb8
SSDEEP 3072:SO0soglEIV5jtbY94AcTJf8w4ChCSppLJEHCxFWAJHLLQAuughlf:SO/o0jjtS4dTJfhfxHJHPhuug
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-23524.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-23524.exe
Size 468KB
SHA256 422fcd5a0efee186b306cc3e634b46118fd2602f9792f9dfc2dbabb047faee88
MD5 1f237f5f5a36e6498be7eb84117ad4a5
SHA1 188a2bdc3eeddba1cf821b705081c1dd7c8d6ee6
SHA512 94437cbeb31729942ce9aa911408810cf88a448bb5b442008109a03e317fadf8878fc1183587fd0a7816c4163c7cec13df85beeb818555583c0b72617bfe7744
SSDEEP 3072:SO0soglEIV5jtbY94AcTJf8w4ChCSppqJEHCxFWAJHLLQAqughlf:SO/o0jjtS4dTJfhfYHJHPhqug
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-25588.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-25588.exe
Size 468KB
SHA256 00a9f68d654ecbeb726412d6efc0a68962de77ec647337e5d24e9746d2e25c48
MD5 295553b6f67a73554cf72ee7ee06e71d
SHA1 70b9354972b1c38ca053ed791ca4c2710f78fd7a
SHA512 ecd67fd4d26069b3437b9e8fed993981033bf9f230c4fe15b3a2d7e207d1e55b9c064e9da0258f8034b254f3d8f114171909c3b8732fb4e3c187645f80290298
SSDEEP 3072:SO0soglEIV5jtbY94AcTJf8w4ChCSppqJEHC7FWAJHSLQAqEgylf:SO/o0jjtS4dTJfhfYJJH0hqEg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-25972.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-25972.exe
Size 468KB
SHA256 bc8317dc87ea4042738408a1335e49e009f8c68db59598b5a5a8a8380c61a875
MD5 2b6b6f35f8dc20ef31894dfae8adbc98
SHA1 f5e2672c727a61dbfb7530343e0d2362cf273bab
SHA512 45b89332fc2af1d6ce6d17ce2542ad8a9bff874ab4a74fbd154c02a5a5597ef3cfb58232efde5527c46c034af72fc42ca3ea9638e42667be3840e7a979b64df7
SSDEEP 3072:SO0soglEIV5jtbY94AcTJf8w4ChCSppqJEHC/FWAJHSLQAqEgylf:SO/o0jjtS4dTJfhfYtJH0hqEg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-29726.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-29726.exe
Size 468KB
SHA256 4462010f629abf059a6192c181bc1a61fab1977b7090620e834cac633aa5b635
MD5 332935fff72e72c4e3eac8c32cae241a
SHA1 aed9b6a744a0b486e53cf9dcf3e832c67a8ab3db
SHA512 f8ffd30104af18db813f4fc2b6c894f84a815ad1273a9a5cdd6c56a4a4ab39b472fb6699b17f8ddc3d113cb515da428b8d611edf220d9b9596f43f3e7142115d
SSDEEP 3072:SO0soglEIV5jtbY94AcTJf8w4ChCSppqJEHCxFWAJHLLhAqughlf:SO/o0jjtS4dTJfhfYHJHPiqug
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-31060.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-31060.exe
Size 468KB
SHA256 d3ab65a7b7c516db712cdec6a3dd8ae6da0415a33934b31bce15b5c532ab46e7
MD5 50d678a11af78a9ba0188d92d1575368
SHA1 d090c71c0219ffa5d876fecf2871258b2b8f5bc4
SHA512 7d5a03a0861d0fb56b57d45e2cdfb56aeae7e83128938ee3590f420a56da4b9ff745e6421edd61e36cd89a34c38d27451af0a1a23f978e76810e807d22096050
SSDEEP 3072:SO0so2lEIV5jtbY94AcTJf8w4ChCSppLJEHCxFZbJHLLQAqughlf:SO/oyjjtS4dTJfhfxdJHPhqug
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-33745.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-33745.exe
Size 468KB
SHA256 7eb62beca02c5c928f5cff32ecc3b5a322ee6079f51354533f312ab86f81b8fe
MD5 dafc7508f34b28479d8961a2c51913fc
SHA1 0ede4b43af91ab745b95f57a6f3c6873db50ebae
SHA512 e3fb361552d4b1d3ca47ff1a0e176db1acf88fa9048eae1613dcb9d486d2b92621a7a5852b9ef50e247b7f00ec469a149481c56c2c1004b52f6a9ee8037512a4
SSDEEP 3072:SO0soglEIV5jtbY94AcTJf8w4ChCSppLJEHCxFZAJHLLQAqughlf:SO/o0jjtS4dTJfhfxeJHPhqug
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-3482.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-3482.exe
Size 468KB
SHA256 68a6b8a66542dc08b19a4d58cc55cdc37deb006ea20f2858263dab15764353ac
MD5 f0420bfae711292b23303f6021e66660
SHA1 167032387f2162f8b6e22688ecd22501fb65717b
SHA512 f9fe66cff7fc36d99854f938a10923090320b4610036e5e8bf60e48c04c617ed7af0872b34e060fc265216b28f435cef7deca1b7fc13692913674ed59748c802
SSDEEP 3072:SO0soglEIV5jtbY94AcTJf8w4ChCSppqJEHCxFWArHLLQAqughlf:SO/o0jjtS4dTJfhfYHrHPhqug
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-36450.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-36450.exe
Size 468KB
SHA256 7275c660feb2fcd563823b8dbf08153be08f03551bf10a56570ee3763a231660
MD5 557d942ac5cd91b1fb45a5703f44a1e2
SHA1 f7c31f5393b5e442954965281625fb5eccf078f4
SHA512 37480b5fffc8a077b0e0dd68848560fc9d3be33243a585a57f51f0dc84f706e4fd82ba0d069beab24bab075a5fd740332be02674147c719b5aac31b5d406bd4c
SSDEEP 3072:SO0soglEIV5jtbY94AcTJf8w4ChCSppqJEHCxFWwJHLLQAqughlf:SO/o0jjtS4dTJfhfY3JHPhqug
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-36850.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-36850.exe
Size 468KB
SHA256 84c6e9b13a8d8462a98876fbd0830b029e0f11e0d67b38713a10245217f2832f
MD5 25a02187faf7050f7d99abb82c8c3e2a
SHA1 e130be22b3007e9563d4e564b557fb0ae6a72096
SHA512 614b26866f09fd759a1dc931602cc18bc53b8164a614f2461cb56d2330f30ae56e36e0f584b42d4f67d90af12060eec87c0afb842749afc8761add4320819725
SSDEEP 3072:SO0soglEIV5jtbY94AcTJf8w4ChCSppqJEHCxFWMJHALQAqughlf:SO/o0jjtS4dTJfhfY7JHqhqug
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-38386.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-38386.exe
Size 468KB
SHA256 b9d28fa1f2e6019464fad77d936b8c75091f6d05150274c7f1a72ba311e5a189
MD5 b355c437a34fab781f936017919451ae
SHA1 2f1059b43dc83e91656006c102f8f73cecc3bde5
SHA512 51b1544f1093d34dce8d6e1edebca41764b84ca47cf13d0caab0f40e7bc57b5cd1bdaffc1dd284054329d37a0cb365e9bd05321aaf9d477c45a6832198d6f555
SSDEEP 3072:SO0soglEIV5jtbY94AcTJf8w4ChCSppLJEHCxFW4JHLLQAuughlf:SO/o0jjtS4dTJfhfxvJHPhuug
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-38586.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-38586.exe
Size 468KB
SHA256 65092bba36ca27407cbd0718e33bf00bdb832ee4aca1a8e9f70fdd1372447631
MD5 879aa14af67b0891dfd644973b0408af
SHA1 ab6418732cf51b1f9da089ce76321e5c574b8ab2
SHA512 3ecd1e86697a8e5ed4992d3dcacb36fa6205b41e39a9e1c4d7196faab9166686cde074f06a4840c2820808fd5297b1892a3fb6ee52a2981e99765d51e4945c63
SSDEEP 3072:SO0soglEIV5jtbY94AcTJf8w4ChCSppqJEHCxFWAJHSLQAqEghlT:SO/o0jjtS4dTJfhfYHJH0hqEg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-38970.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-38970.exe
Size 468KB
SHA256 3ebf96a89f38169a11e3fdf080b17ec571b29bd3ca35cea9eb4c67e33ced2aaf
MD5 786b36656b9a3f51eaa2102099a0ec92
SHA1 18b47cbab70cd650dbf2f35bed0f2219c4544d5a
SHA512 5fe16ee883e2258a00d72aac9621bfed68015c169fdbb2517aa6814229834f54a91854e806c04e70a4923be20f514299f1e72e65d248caf87583f508c80023c3
SSDEEP 3072:SO0soglEIV5jtbY94AcTJf8w4ChGSppqJEHCxFWAJHALQAqughlp:SO/o0jjtS4dTJf1fYHJHqhqug
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-39876.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-39876.exe
Size 468KB
SHA256 c8807f03e06e7edf78680f9a64bbb07fcf6686aa59ce71898b3b4531e9c39a15
MD5 7f15dda810595e544f0725f9c3ec9842
SHA1 a6e8051de82a66fdbac5112b007ef42cbd440b6c
SHA512 311d4f74ea25bad7b1b5920a97185d45a15b03a95d86e9aee78c867fc037100c440de89a198d00d875814f73d932f8f25e9b3daaa61676466bfef949fd71d97c
SSDEEP 3072:SO0soglEIV5jtbY94AcTJf8w4ChCSppLJEHCxFWAJHRLQAuughlf:SO/o0jjtS4dTJfhfxHJHNhuug
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-40788.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-40788.exe
Size 468KB
SHA256 58b0150d8b68084f7189293b64d69ef20142c3a950d4c752c80c1f6a2d5e3c82
MD5 2d618bf9f3591ce5c21aca8b89420b28
SHA1 e9b2835081aad32dd19a1aa1f96cf23ca20c1b54
SHA512 9d0207ecf200afa55b1874f39b4cf69b33eff88ca864b62dc527bf5a2b84ad4d0508c2099a7fdb6160f563e65349832c12622681bb05b41b1a3adeb731248803
SSDEEP 3072:bO0soglEIV5jtbY94AcTJf8w4ChCSppLJEHCxFZAJHPLQAqughlf:bO/o0jjtS4dTJfhfxeJHzhqug
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-41895.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-41895.exe
Size 468KB
SHA256 eb186c259b189ba7f965d79c81b819bf6cd0346f92940d5620d3c48d5c200511
MD5 aa9d8807a1118a1d063d91a8f4901240
SHA1 a7ad836befc79eb4d578e67a80f1fbe9b1e52291
SHA512 2991e9e18d4be61d943415f6c4cae7bab71f2b1a9393e781bcce874e2e1be482ab55a423a0bd17564f8e21e597cc6f4f95a1ea016b2d1bbaea2d7fe9a7900c1e
SSDEEP 3072:SO0soglEIV5jtbY94AcTJf8w4ChCSppqJEHCxFWAJHSLQAqEghlf:SO/o0jjtS4dTJfhfYHJH0hqEg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-41946.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-41946.exe
Size 468KB
SHA256 570e20359b8caca48f4ce5e434066707acc02556b29ad857676225ebed029048
MD5 07fea9251b6a53e538c45910c3eb2dc0
SHA1 8275a98b84936da1ff4e25e56eb58930d800a48f
SHA512 9fdb9721bfe313b05a5b14ece20a8ca8ad2ef3f4c417a6359ec51c2eea276811b8cae1b886e0eadd5d7cf81aeadb75b7d6159c5d8aed346e872751cce623091b
SSDEEP 3072:SONsoglEIV5jtbY94AcTJf8w4ChCSppqJEHCxFWAJHALQAqEghlf:SOyo0jjtS4dTJfhfYHJHqhqEg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-42315.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42315.exe
Size 468KB
SHA256 58e96ff2a98e4185969c415562ee7185ff5b9b856ea600cf5e978452ebe3e1b3
MD5 14cbcd54f56519e4facea22889a9febe
SHA1 72794298a6f756c9ffc32758f9f74726938f53e0
SHA512 a102aa2a8746d033b799c9b79169642ebeb51ccf0dffd42900e2d31c80a6f2c4ede5c26dfe4ae104cc3bf7d1a9daf2ba9cd372d009fffd7933be051145776392
SSDEEP 3072:SO0soglEIV5jtbY94AcTJf8w4ChCSppLJEHCxFWAJHLLQAqugylf:SO/o0jjtS4dTJfhfxHJHPhqug
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-42580.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42580.exe
Size 468KB
SHA256 6c4a491942ef8a56f1c327cd6d5be79a3dee4bdeb985f59c2ef621cf9a6e08e2
MD5 53572a128a5c17c74071a1b8f0a5e41a
SHA1 8f91c5ccf8c7c379d462232b7114ce079ea45481
SHA512 fce854d9d5878989676183297be663cf126f8c75b57c70d7c51c1fa839b437fd7bb0c0590125f43d617ad858b22c02ab4e27a1eb07dc9da422795e5627be463a
SSDEEP 3072:SO0soglEIV5jtbY94AcTJf8w4ChCSppqJEHCxFWArHSLQAqughlf:SO/o0jjtS4dTJfhfYHrH0hqug
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-42647.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42647.exe
Size 468KB
SHA256 2e99fa368e2833afba2758f7fa85f65bcaa4a6dbcab4d12259b86e525364c781
MD5 15615913d756d5c3741f9f6f7efdc365
SHA1 d349cb645ebb333ffe5530e3adf1e8178cd94a57
SHA512 7e93c7ae059cc3aa66355e7a65c51080776e670c6179cda250ed44baf44ebba1f4b7449d124c11b3601e1ba03767d7a452ec58e6abc16ba639079731a1f7e570
SSDEEP 3072:SO0soglEIV5jtbY94AcTJf8w4ChCSppqJEHCxFWAJHALQAqughlf:SO/o0jjtS4dTJfhfYHJHqhqug
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-43482.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-43482.exe
Size 468KB
SHA256 b9fcb7f293e26501056f4139adea1532039bc3c2518621d1f2a55fd1af53fcc1
MD5 8a650f29824cda7f1875f9c5972be384
SHA1 f0856862fb7491e77517f0c92775d1571b3c3ddc
SHA512 eb467ca64e41693078229b147e7c022c5e4a3369360054b90f5ed0f8f2a1cf88b4ad9c985fc30867adc9f2f74ee50a2c01b09afed0df72cc16f0c454d522c6f0
SSDEEP 3072:SO04oglEIV5jtbY94AcTJf8w4ChCSppqJEHCxFWArHLLQAqughlf:SO7o0jjtS4dTJfhfYHrHPhqug
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-47204.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-47204.exe
Size 468KB
SHA256 7347e681b9b9559e4aee525337e843a3b3fa0ad719599a75638fe5b9c8ec7d4c
MD5 150d5590e1de91e75f5ce192dc62399b
SHA1 b8de22b562a538d0bcd9afca560c9a5462978d95
SHA512 13c3bf48df284111493462c8e0d744485e47196621bdfde1d872a0e2b907c78efd459cdb10c62a5a7f217ce5b994f651b04305bf31ee880fb04f7fb2bfdd5120
SSDEEP 3072:SO0soglEIV5jtbY94AcTJf8w4ChCSppLJEHCxFWAJHLL+Aqugylf:SO/o0jjtS4dTJfhfxHJHP3qug
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-51079.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-51079.exe
Size 468KB
SHA256 23fd6a47af7d76f9a560239efe6ebc5a3bdc7d157454f60b88c356764f20effb
MD5 59ee2ddebb221bf8acbe9e5628e78f9a
SHA1 8e4bd25f8ebf0bba27fcbac0032acd4643592f87
SHA512 bde72f6be97155da4aa4001e44c834c2994ee8ae514e8a228b29b378fc4c5d99436b1c3088c5832357c6099cbe85352c99063d2c8bf57794f0210495a38c841b
SSDEEP 3072:wO0soglEIV5jtbY94AcTJf8w4ChCSppqJEHCxFWAJHLLzA3ughlf:wO/o0jjtS4dTJfhfYHJHPU3ug
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-54418.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-54418.exe
Size 468KB
SHA256 cdb55a95a0ced96474b6aedf27685b261d817977a42f93cb309bc24e5f6d46bc
MD5 d376117f87fe1992fa00e82345d45d6e
SHA1 31dde8a5a162db669913e6838852b55ee34aa94d
SHA512 68566cf234bdd25b1ab71fda695f6cb6e1ef853c80344a563ce3007c900541505ecae70618e2af76695bb5d255f1df7398218c2082501d62c677b9fda12d5074
SSDEEP 3072:SO0soglEIV5jtbY94AcTJf8w4ChCSppLJEHCxFWAJHLLQAqugulf:SO/o0jjtS4dTJfhfxHJHPhqug
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-54894.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-54894.exe
Size 468KB
SHA256 6d1dd0adf899aa49d71f250b9aa15460862e822fb3e32e3adff6d1d84e3e8782
MD5 927bb9404594ab7f5b4f06e67f2beb44
SHA1 7b4519ca338fa7e0e8ec277a8d2866d54b736f4b
SHA512 cb4df0e5b6c2f633571a404b10cefc6e4aed9243f33db47b22754d17cd5f99974793e030fe8ac58973192e37c442d6816779975a4bad1a56477f4572d2af6abf
SSDEEP 3072:SO0soglEIV5jtbY94AcTJf8w4ChGSppqJEHCxFWAJHALQAqughlf:SO/o0jjtS4dTJf1fYHJHqhqug
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-56404.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-56404.exe
Size 468KB
SHA256 80546b080150c307d2c5dc9ac1df5cd7ae320536a98f48ad4ad2ee1b026e1e46
MD5 1dfe40cc2aaa437f74ac5851ffb977f0
SHA1 496f317a168aec0b23875d9509fa898209347aff
SHA512 21eeec429e0dc02d2eb542d059b30b28dfc83ad4673fb3b28dfe3efa604ebc007aec83650cfec2eb752fe97006d84c984157b1744ad6214aa906589d9526bb71
SSDEEP 3072:SO0soglEIV5jtbY94AcTJf8w4ChCSppqJEHCxFWAJHALQAqEghlf:SO/o0jjtS4dTJfhfYHJHqhqEg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-59134.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-59134.exe
Size 468KB
SHA256 eb553cbccf12f5ba96fc12f56d7c860a269698fa1b9fbdab9f10aeaa224cc62d
MD5 a068e54b19bb54d20f1f1097a1df6042
SHA1 6511aab1e28226a6e488ff44bf1b8b408d3858d8
SHA512 08d1d550591cfa9df2abbd310d877b8132acbb44aff3cffe170192a14c818d0fab99dfceb447638dd9a7df1253e52fc765fbfcd26ebcb4f8ab3bdca853018cae
SSDEEP 3072:SO0soglEIV5jtbY94AcTJf8w4ChCSppLJTHCxFZAJHLLQAqughlf:SO/o0jjtS4dTJfhfgeJHPhqug
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-59508.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-59508.exe
Size 468KB
SHA256 136ae8b66dd9b4557f3db1562c85ee5e8088d0e4dd9277335b22b006dd7d5ea7
MD5 8e2791abe9ea8e300600881440f74c44
SHA1 cde5594c005f22c8d30ec5b2381633a53ff7b004
SHA512 f9a285be33632ace3517a692ef98e6f3d4d598b2907ff50c947e6f7649bcd5f84cba9620974ad435b4f2fb8c0ffabe6d74a7e839bf5c1699f354d648fbbdfa6b
SSDEEP 3072:SO0soglEIV5jtbY94AcTJf8w4ChCSppqJEHCxFWAJHSLQAqEgylf:SO/o0jjtS4dTJfhfYHJH0hqEg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-60167.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-60167.exe
Size 468KB
SHA256 a6bd260e404541e970659c2ca4ec555727883f302305a14a172e7a20752d746d
MD5 bc0859cee9357f956cd83a7b7dd696b6
SHA1 507f5ca329c0cc664b6dd0f22f16a538dd140b82
SHA512 3a9e8c3d345f9a63957b0bf3e7990ba5f8e553aa17906174ab6a09e4fd1898d240b6d6b218552d2334c7e3372457d97b17ebaafce864358c4104823ee433f6be
SSDEEP 3072:SO0soglEIV5jtbY94AcTJf8w4ChCSppLJEHCxFWAJSLLQAuugolf:SO/o0jjtS4dTJfhfxHJSPhuug
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-62813.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-62813.exe
Size 468KB
SHA256 a1a97d28910b746dc2f6920d313056b4f1125976e2d74ef8bb20f7f5b28fa572
MD5 f1330c44e56e7b961b696542f95d52fd
SHA1 919559f12352400f2bcacbe5b41bb18d4f54343b
SHA512 038f9ceda73e4d383357c44871c7323ed05764a66a81985524794808a821195e7d48e1372e14c9e2408d8227abda7dd07980a68e72b39ab2f40e7c2e5c72e798
SSDEEP 3072:aO0soglEIV5jtbYo4AcTJf8w4ChCSppqJEHCxFWArHLLQAqughlf:aO/o0jjtT4dTJfhfYHrHPhqug
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-6378.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-6378.exe
Size 468KB
SHA256 b2ea4009aeb3d0e82f93ae54c26d242949e435ffbc83340c13c461a6d4fa16a2
MD5 1da97b037526a3c1dfc69be59b9cd88c
SHA1 1551e24c2a4e19c41f225ded236f3fd4772389b4
SHA512 b5a4b66b6af1eda368388a7faf5effa285e5051d12146f120360a8cefc4051f4fa9d7d8b9e48692bed2c2e66fc98da4fdacf27fe97c3ec3f0daf9c6fd06ee6ee
SSDEEP 3072:SO0soglEIV5jtbY94AcTJf8w4ChCSppLJEHCxFWAJSLLQAuughlf:SO/o0jjtS4dTJfhfxHJSPhuug
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-9715.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-9715.exe
Size 468KB
SHA256 e08999e48d570b6a33a857b6e9275ac6ac32e0ede87a5175588bd157984ef554
MD5 c0c55c324b22e2118704a03165ae2a7f
SHA1 52e5b093b4f414be868ee4f2732389cba71c6023
SHA512 859fb70deae2a13b57e2342ad3c3199935c8434cdab34eb97afe3c0d4db2eb7b1fb46c963386a231d54a1781e7e02f37bbbe753cd726b7abacfe3dfa62e42dfc
SSDEEP 3072:SO0so2lEIV5jtbY94AcTJf8w4ChCSppLJEHCxFZAJHLLQAqughlf:SO/oyjjtS4dTJfhfxeJHPhqug
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/16376-2787-0x00000000757B0000-0x0000000075846000-memory.dmp

Download

memory/17400-5101-0x00007FFDF8AF0000-0x00007FFDF8CE5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads