41ada161c2893881cb9cb930b4bca213c73320cdbb12030af088440655af8deb

Analysis

max time kernel
120s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 14:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41ada161c2893881cb9cb930b4bca213c73320cdbb12030af088440655af8debN.exe
Size

468KB
MD5

5d858e11a6ea6aa440ec1c8a7b06bc00
SHA1

29a44b982ddb41af0cf059071ed553c884b4fcb5
SHA256

41ada161c2893881cb9cb930b4bca213c73320cdbb12030af088440655af8deb
SHA512

31c9571eefdfe8bed9f12d886b377128eba2f29101170b752c17d84704ba932eefe27684cd11a4dcbc68cbcce1c654b3804cdf81b05c2722e3d84ae2f319a2e3
SSDEEP

3072:ibIeogWCBd5ItbY4Pztjof8BRCMvPgpan0HeGfqEclI8dMRLk9lh:ibBoYbItXPJjofgc+cclZGRLk

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1856	Unicorn-10001.exe
1964	Unicorn-28222.exe
220	Unicorn-8356.exe
656	Unicorn-34802.exe
836	Unicorn-34802.exe
3364	Unicorn-6768.exe
1152	Unicorn-20503.exe
752	Unicorn-58450.exe
4668	Unicorn-50282.exe
2312	Unicorn-30416.exe
3880	Unicorn-5165.exe
1076	Unicorn-20110.exe
3796	Unicorn-39711.exe
4112	Unicorn-60488.exe
1484	Unicorn-40888.exe
2508	Unicorn-40142.exe
4044	Unicorn-31974.exe
1384	Unicorn-36612.exe
4992	Unicorn-60562.exe
4008	Unicorn-46264.exe
4064	Unicorn-52949.exe
3812	Unicorn-7277.exe
3044	Unicorn-11361.exe
1864	Unicorn-64646.exe
760	Unicorn-24766.exe
3696	Unicorn-8984.exe
1600	Unicorn-28585.exe
1080	Unicorn-22719.exe
2392	Unicorn-32171.exe
1124	Unicorn-24447.exe
640	Unicorn-30578.exe
5028	Unicorn-9581.exe
2500	Unicorn-27204.exe
5088	Unicorn-63406.exe
4868	Unicorn-51346.exe
4176	Unicorn-37048.exe
652	Unicorn-53053.exe
2924	Unicorn-48222.exe
1244	Unicorn-64558.exe
1048	Unicorn-56390.exe
1188	Unicorn-19826.exe
1468	Unicorn-19826.exe
4972	Unicorn-40246.exe
400	Unicorn-34115.exe
444	Unicorn-20380.exe
4760	Unicorn-64750.exe
4660	Unicorn-64750.exe
3460	Unicorn-62704.exe
4932	Unicorn-60837.exe
472	Unicorn-15165.exe
4980	Unicorn-15165.exe
4100	Unicorn-31237.exe
4540	Unicorn-63405.exe
4464	Unicorn-23069.exe
4432	Unicorn-3468.exe
960	Unicorn-7552.exe
3064	Unicorn-18487.exe
756	Unicorn-61434.exe
3932	Unicorn-20018.exe
3048	Unicorn-19752.exe
4340	Unicorn-57521.exe
4404	Unicorn-13556.exe
316	Unicorn-33422.exe
1496	Unicorn-16894.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
5368	4952	WerFault.exe	165
8048	6596	WerFault.exe	250
10816	9996	WerFault.exe	442
4684	15728	WerFault.exe	759
2236	15412	WerFault.exe	745

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14784.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39036.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3565.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40978.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64854.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27028.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17603.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37676.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51124.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5833.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20907.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16522.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2996.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21700.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61137.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24447.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16334.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7140.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18314.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54348.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56533.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3311.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41647.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64558.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26598.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59185.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48085.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9122.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32927.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64714.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29168.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42918.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50106.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57418.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23929.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28585.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4169.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37558.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16260.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34519.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7383.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57205.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61820.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17399.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51346.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56634.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57418.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40967.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34603.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56530.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61820.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26785.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49945.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33557.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	10036	dwm.exe
Token: SeChangeNotifyPrivilege	10036	dwm.exe
Token: 33	10036	dwm.exe
Token: SeIncBasePriorityPrivilege	10036	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1556	41ada161c2893881cb9cb930b4bca213c73320cdbb12030af088440655af8debN.exe
1856	Unicorn-10001.exe
220	Unicorn-8356.exe
1964	Unicorn-28222.exe
836	Unicorn-34802.exe
656	Unicorn-34802.exe
3364	Unicorn-6768.exe
1152	Unicorn-20503.exe
2312	Unicorn-30416.exe
752	Unicorn-58450.exe
4668	Unicorn-50282.exe
3880	Unicorn-5165.exe
4112	Unicorn-60488.exe
3796	Unicorn-39711.exe
1076	Unicorn-20110.exe
1484	Unicorn-40888.exe
2508	Unicorn-40142.exe
4044	Unicorn-31974.exe
1384	Unicorn-36612.exe
4992	Unicorn-60562.exe
1864	Unicorn-64646.exe
4008	Unicorn-46264.exe
760	Unicorn-24766.exe
4064	Unicorn-52949.exe
3812	Unicorn-7277.exe
3696	Unicorn-8984.exe
3044	Unicorn-11361.exe
1600	Unicorn-28585.exe
2392	Unicorn-32171.exe
1080	Unicorn-22719.exe
1124	Unicorn-24447.exe
640	Unicorn-30578.exe
5028	Unicorn-9581.exe
2500	Unicorn-27204.exe
5088	Unicorn-63406.exe
4868	Unicorn-51346.exe
4176	Unicorn-37048.exe
652	Unicorn-53053.exe
2924	Unicorn-48222.exe
1244	Unicorn-64558.exe
1048	Unicorn-56390.exe
1188	Unicorn-19826.exe
1468	Unicorn-19826.exe
4972	Unicorn-40246.exe
4100	Unicorn-31237.exe
3460	Unicorn-62704.exe
4660	Unicorn-64750.exe
444	Unicorn-20380.exe
472	Unicorn-15165.exe
960	Unicorn-7552.exe
4932	Unicorn-60837.exe
4760	Unicorn-64750.exe
4980	Unicorn-15165.exe
4464	Unicorn-23069.exe
4540	Unicorn-63405.exe
4432	Unicorn-3468.exe
3064	Unicorn-18487.exe
400	Unicorn-34115.exe
3932	Unicorn-20018.exe
756	Unicorn-61434.exe
3048	Unicorn-19752.exe
4340	Unicorn-57521.exe
4404	Unicorn-13556.exe
316	Unicorn-33422.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 1856	1556	41ada161c2893881cb9cb930b4bca213c73320cdbb12030af088440655af8debN.exe	84
PID 1556 wrote to memory of 1856	1556	41ada161c2893881cb9cb930b4bca213c73320cdbb12030af088440655af8debN.exe	84
PID 1556 wrote to memory of 1856	1556	41ada161c2893881cb9cb930b4bca213c73320cdbb12030af088440655af8debN.exe	84
PID 1856 wrote to memory of 1964	1856	Unicorn-10001.exe	86
PID 1856 wrote to memory of 1964	1856	Unicorn-10001.exe	86
PID 1856 wrote to memory of 1964	1856	Unicorn-10001.exe	86
PID 1556 wrote to memory of 220	1556	41ada161c2893881cb9cb930b4bca213c73320cdbb12030af088440655af8debN.exe	85
PID 1556 wrote to memory of 220	1556	41ada161c2893881cb9cb930b4bca213c73320cdbb12030af088440655af8debN.exe	85
PID 1556 wrote to memory of 220	1556	41ada161c2893881cb9cb930b4bca213c73320cdbb12030af088440655af8debN.exe	85
PID 1964 wrote to memory of 656	1964	Unicorn-28222.exe	87
PID 1964 wrote to memory of 656	1964	Unicorn-28222.exe	87
PID 1964 wrote to memory of 656	1964	Unicorn-28222.exe	87
PID 220 wrote to memory of 836	220	Unicorn-8356.exe	88
PID 220 wrote to memory of 836	220	Unicorn-8356.exe	88
PID 220 wrote to memory of 836	220	Unicorn-8356.exe	88
PID 1856 wrote to memory of 3364	1856	Unicorn-10001.exe	89
PID 1856 wrote to memory of 3364	1856	Unicorn-10001.exe	89
PID 1856 wrote to memory of 3364	1856	Unicorn-10001.exe	89
PID 1556 wrote to memory of 1152	1556	41ada161c2893881cb9cb930b4bca213c73320cdbb12030af088440655af8debN.exe	90
PID 1556 wrote to memory of 1152	1556	41ada161c2893881cb9cb930b4bca213c73320cdbb12030af088440655af8debN.exe	90
PID 1556 wrote to memory of 1152	1556	41ada161c2893881cb9cb930b4bca213c73320cdbb12030af088440655af8debN.exe	90
PID 836 wrote to memory of 752	836	Unicorn-34802.exe	95
PID 836 wrote to memory of 752	836	Unicorn-34802.exe	95
PID 836 wrote to memory of 752	836	Unicorn-34802.exe	95
PID 1964 wrote to memory of 2312	1964	Unicorn-28222.exe	96
PID 1964 wrote to memory of 2312	1964	Unicorn-28222.exe	96
PID 1964 wrote to memory of 2312	1964	Unicorn-28222.exe	96
PID 3364 wrote to memory of 4668	3364	Unicorn-6768.exe	97
PID 3364 wrote to memory of 4668	3364	Unicorn-6768.exe	97
PID 3364 wrote to memory of 4668	3364	Unicorn-6768.exe	97
PID 1152 wrote to memory of 3880	1152	Unicorn-20503.exe	98
PID 1152 wrote to memory of 3880	1152	Unicorn-20503.exe	98
PID 1152 wrote to memory of 3880	1152	Unicorn-20503.exe	98
PID 220 wrote to memory of 1076	220	Unicorn-8356.exe	99
PID 220 wrote to memory of 1076	220	Unicorn-8356.exe	99
PID 220 wrote to memory of 1076	220	Unicorn-8356.exe	99
PID 1556 wrote to memory of 3796	1556	41ada161c2893881cb9cb930b4bca213c73320cdbb12030af088440655af8debN.exe	100
PID 1556 wrote to memory of 3796	1556	41ada161c2893881cb9cb930b4bca213c73320cdbb12030af088440655af8debN.exe	100
PID 1556 wrote to memory of 3796	1556	41ada161c2893881cb9cb930b4bca213c73320cdbb12030af088440655af8debN.exe	100
PID 1856 wrote to memory of 4112	1856	Unicorn-10001.exe	101
PID 1856 wrote to memory of 4112	1856	Unicorn-10001.exe	101
PID 1856 wrote to memory of 4112	1856	Unicorn-10001.exe	101
PID 656 wrote to memory of 1484	656	Unicorn-34802.exe	103
PID 656 wrote to memory of 1484	656	Unicorn-34802.exe	103
PID 656 wrote to memory of 1484	656	Unicorn-34802.exe	103
PID 2312 wrote to memory of 2508	2312	Unicorn-30416.exe	104
PID 2312 wrote to memory of 2508	2312	Unicorn-30416.exe	104
PID 2312 wrote to memory of 2508	2312	Unicorn-30416.exe	104
PID 3880 wrote to memory of 4044	3880	Unicorn-5165.exe	105
PID 3880 wrote to memory of 4044	3880	Unicorn-5165.exe	105
PID 3880 wrote to memory of 4044	3880	Unicorn-5165.exe	105
PID 1152 wrote to memory of 1384	1152	Unicorn-20503.exe	106
PID 1152 wrote to memory of 1384	1152	Unicorn-20503.exe	106
PID 1152 wrote to memory of 1384	1152	Unicorn-20503.exe	106
PID 4668 wrote to memory of 4992	4668	Unicorn-50282.exe	107
PID 4668 wrote to memory of 4992	4668	Unicorn-50282.exe	107
PID 4668 wrote to memory of 4992	4668	Unicorn-50282.exe	107
PID 1964 wrote to memory of 4008	1964	Unicorn-28222.exe	108
PID 1964 wrote to memory of 4008	1964	Unicorn-28222.exe	108
PID 1964 wrote to memory of 4008	1964	Unicorn-28222.exe	108
PID 3364 wrote to memory of 4064	3364	Unicorn-6768.exe	109
PID 3364 wrote to memory of 4064	3364	Unicorn-6768.exe	109
PID 3364 wrote to memory of 4064	3364	Unicorn-6768.exe	109
PID 4112 wrote to memory of 3812	4112	Unicorn-60488.exe	110

C:\Users\Admin\AppData\Local\Temp\41ada161c2893881cb9cb930b4bca213c73320cdbb12030af088440655af8debN.exe
"C:\Users\Admin\AppData\Local\Temp\41ada161c2893881cb9cb930b4bca213c73320cdbb12030af088440655af8debN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10001.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10001.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28222.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28222.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34802.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40888.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30578.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20018.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55762.exe
        8⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
        9⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48025.exe
        10⤵
        
        PID:10268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16704.exe
        10⤵
        
        PID:17108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40531.exe
        10⤵
        
        PID:8932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27028.exe
        9⤵
        
        PID:9500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5499.exe
        9⤵
        
        PID:14520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39072.exe
        8⤵
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59530.exe
        9⤵
        
        PID:9652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57301.exe
        9⤵
        
        PID:14616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17603.exe
        8⤵
        
        PID:11284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18314.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:16248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2123.exe
        9⤵
        
        PID:18012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26653.exe
        8⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50344.exe
        8⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-292.exe
        7⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3925.exe
        8⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57418.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        9⤵
        
        PID:10000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53855.exe
        9⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7184.exe
        8⤵
        
        PID:10616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20787.exe
        8⤵
        
        PID:15368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54204.exe
        8⤵
        
        PID:9008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32927.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28010.exe
        8⤵
        
        PID:10832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39428.exe
        8⤵
        
        PID:17272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2927.exe
        8⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53593.exe
        7⤵
        
        PID:11980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10779.exe
        7⤵
        
        PID:16152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54852.exe
        7⤵
        
        PID:8312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57521.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55762.exe
        7⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40490.exe
        8⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64854.exe
        9⤵
        
        PID:9552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43512.exe
        9⤵
        
        PID:14120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45111.exe
        9⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27028.exe
        8⤵
        
        PID:9716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5499.exe
        8⤵
        
        PID:14008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39072.exe
        7⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34137.exe
        8⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17603.exe
        7⤵
        
        PID:11328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15787.exe
        7⤵
        
        PID:5000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53908.exe
        6⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37558.exe
        7⤵
        
        PID:7500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30950.exe
        8⤵
        
        PID:12536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45132.exe
        8⤵
        
        PID:18148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15823.exe
        7⤵
        
        PID:10612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7576.exe
        7⤵
        
        PID:16528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53359.exe
        7⤵
        
        PID:13752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27309.exe
        6⤵
        
        PID:8232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49780.exe
        6⤵
        
        PID:10852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36044.exe
        6⤵
        
        PID:15000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17480.exe
        6⤵
        
        PID:18312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24447.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61434.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55762.exe
        7⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60142.exe
        8⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41466.exe
        9⤵
        
        PID:9852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44473.exe
        9⤵
        
        PID:14312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53855.exe
        9⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27028.exe
        8⤵
        
        PID:9492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14784.exe
        8⤵
        
        PID:15080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23426.exe
        8⤵
        
        PID:8368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42580.exe
        7⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4133.exe
        8⤵
        
        PID:9996
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9996 -s 468
        9⤵
        Program crash
        
        PID:10816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60233.exe
        8⤵
        
        PID:13964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14794.exe
        8⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53592.exe
        7⤵
        
        PID:10296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35397.exe
        7⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60951.exe
        7⤵
        
        PID:8592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40172.exe
        6⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50106.exe
        7⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1069.exe
        8⤵
        
        PID:15048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41183.exe
        8⤵
        
        PID:9308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50337.exe
        7⤵
        
        PID:12720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19646.exe
        7⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23747.exe
        6⤵
        
        PID:8408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33373.exe
        6⤵
        
        PID:13064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14599.exe
        6⤵
        
        PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19752.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64506.exe
        6⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
        7⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64854.exe
        8⤵
        
        PID:9560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43512.exe
        8⤵
        
        PID:14128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16522.exe
        8⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27028.exe
        7⤵
        
        PID:9464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5499.exe
        7⤵
        
        PID:14496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31132.exe
        7⤵
        
        PID:7384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39072.exe
        6⤵
        
        PID:7688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17603.exe
        6⤵
        
        PID:11276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22803.exe
        6⤵
        
        PID:1260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64452.exe
        6⤵
        
        PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61537.exe
        5⤵
        
        PID:6748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48954.exe
        6⤵
        
        PID:8436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31593.exe
        6⤵
        
        PID:12688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49903.exe
        6⤵
        
        PID:4060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6869.exe
        5⤵
        
        PID:9132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7407.exe
        5⤵
        
        PID:12396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30339.exe
        5⤵
        
        PID:2596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30416.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40142.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9581.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33422.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55762.exe
        8⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35638.exe
        9⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57418.exe
        10⤵
        
        PID:9928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60809.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:12796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53855.exe
        10⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27028.exe
        9⤵
        
        PID:9640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14784.exe
        9⤵
        
        PID:15204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7090.exe
        9⤵
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18076.exe
        8⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20610.exe
        9⤵
        
        PID:10964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48085.exe
        9⤵
        
        PID:15788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23979.exe
        9⤵
        
        PID:17564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17411.exe
        8⤵
        
        PID:9172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27463.exe
        8⤵
        
        PID:15888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56284.exe
        8⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-292.exe
        7⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4501.exe
        8⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12752.exe
        8⤵
        
        PID:8344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22730.exe
        9⤵
        
        PID:13816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30711.exe
        9⤵
        
        PID:17636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33179.exe
        8⤵
        
        PID:11704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60861.exe
        8⤵
        
        PID:16540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48891.exe
        8⤵
        
        PID:17556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53924.exe
        7⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21578.exe
        8⤵
        
        PID:13668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5387.exe
        8⤵
        
        PID:18476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33557.exe
        7⤵
        
        PID:11772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41985.exe
        7⤵
        
        PID:18424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13556.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27366.exe
        7⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57402.exe
        8⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4281.exe
        9⤵
        
        PID:11620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12107.exe
        9⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6992.exe
        8⤵
        
        PID:10424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55973.exe
        8⤵
        
        PID:17192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16519.exe
        8⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47676.exe
        7⤵
        
        PID:8676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49674.exe
        8⤵
        
        PID:10032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16923.exe
        7⤵
        
        PID:13732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40139.exe
        7⤵
        
        PID:4584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53908.exe
        6⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2996.exe
        7⤵
        
        PID:8284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40336.exe
        7⤵
        
        PID:13340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59720.exe
        7⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29613.exe
        6⤵
        
        PID:8372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33103.exe
        7⤵
        
        PID:6716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24707.exe
        6⤵
        
        PID:1848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39563.exe
        6⤵
        
        PID:8064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27204.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16894.exe
        6⤵
        Executes dropped EXE
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36686.exe
        7⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41066.exe
        8⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64854.exe
        9⤵
        
        PID:9576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43512.exe
        9⤵
        
        PID:14180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18743.exe
        9⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35004.exe
        8⤵
        
        PID:9804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43180.exe
        8⤵
        
        PID:14864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64188.exe
        8⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7132.exe
        7⤵
        
        PID:8024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7271.exe
        7⤵
        
        PID:11652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36975.exe
        7⤵
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1951.exe
        7⤵
        
        PID:8240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36664.exe
        6⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61486.exe
        7⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64854.exe
        8⤵
        
        PID:9584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43512.exe
        8⤵
        
        PID:14140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54348.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35004.exe
        7⤵
        
        PID:9936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7383.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exe
        7⤵
        
        PID:3476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45372.exe
        6⤵
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12641.exe
        7⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12107.exe
        7⤵
        
        PID:1228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33557.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43836.exe
        6⤵
        
        PID:16072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62060.exe
        6⤵
        
        PID:18108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2595.exe
        5⤵
        
        PID:4696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24050.exe
        6⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41066.exe
        7⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32486.exe
        8⤵
        
        PID:12356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3892.exe
        8⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9122.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11076.exe
        7⤵
        
        PID:10352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16704.exe
        7⤵
        
        PID:17084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40531.exe
        7⤵
        
        PID:8812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47676.exe
        6⤵
        
        PID:8660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51681.exe
        6⤵
        
        PID:13088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54371.exe
        6⤵
        
        PID:1452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8180.exe
        5⤵
        
        PID:6408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4221.exe
        6⤵
        
        PID:8400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31593.exe
        6⤵
        
        PID:12608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46779.exe
        6⤵
        
        PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6339.exe
        5⤵
        
        PID:9232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59678.exe
        6⤵
        
        PID:13976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3856.exe
        6⤵
        
        PID:16536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29168.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6852.exe
        5⤵
        
        PID:7536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46264.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64750.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2861.exe
        6⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6473.exe
        7⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64854.exe
        8⤵
        
        PID:9620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50742.exe
        9⤵
        
        PID:13548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43512.exe
        8⤵
        
        PID:14156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20907.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27028.exe
        7⤵
        
        PID:9484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14784.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44039.exe
        7⤵
        
        PID:7044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18076.exe
        6⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57418.exe
        7⤵
        
        PID:9968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44332.exe
        7⤵
        
        PID:15092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57089.exe
        7⤵
        
        PID:7372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57676.exe
        6⤵
        
        PID:8612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14976.exe
        6⤵
        
        PID:14328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56867.exe
        6⤵
        
        PID:8696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11584.exe
        5⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33.exe
        6⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62654.exe
        7⤵
        
        PID:10092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7524.exe
        7⤵
        
        PID:13408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23730.exe
        7⤵
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6992.exe
        6⤵
        
        PID:10432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16704.exe
        6⤵
        
        PID:17116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44615.exe
        6⤵
        
        PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37204.exe
        5⤵
        
        PID:8136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59338.exe
        6⤵
        
        PID:7592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57301.exe
        6⤵
        
        PID:13836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4008.exe
        5⤵
        
        PID:10648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64649.exe
        5⤵
        
        PID:16944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23069.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26598.exe
        5⤵
        
        PID:2168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13541.exe
        7⤵
        
        PID:8960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17472.exe
        7⤵
        
        PID:12412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9122.exe
        7⤵
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53976.exe
        6⤵
        
        PID:6312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38137.exe
        6⤵
        
        PID:14788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40531.exe
        6⤵
        
        PID:8804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39072.exe
        5⤵
        
        PID:7704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48054.exe
        6⤵
        
        PID:13176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42947.exe
        6⤵
        
        PID:16536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35459.exe
        6⤵
        
        PID:6400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17603.exe
        5⤵
        
        PID:10340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19871.exe
        5⤵
        
        PID:4108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59984.exe
        5⤵
        
        PID:6136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22519.exe
      4⤵
      PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16260.exe
        5⤵
        
        PID:7184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16526.exe
        6⤵
        
        PID:10700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48085.exe
        6⤵
        
        PID:15828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31810.exe
        6⤵
        
        PID:18212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24183.exe
        5⤵
        
        PID:12080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7811.exe
        5⤵
        
        PID:2084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1951.exe
        5⤵
        
        PID:5292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34588.exe
      4⤵
      PID:7008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25422.exe
      4⤵
      PID:11744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22835.exe
      4⤵
      PID:16040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15119.exe
      4⤵
      PID:18352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6768.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6768.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50282.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60562.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15165.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63354.exe
        7⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
        8⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24450.exe
        9⤵
        
        PID:8304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33103.exe
        10⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39036.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:10400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51488.exe
        9⤵
        
        PID:16460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48532.exe
        9⤵
        
        PID:9052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7324.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17987.exe
        8⤵
        
        PID:15380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6891.exe
        8⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39072.exe
        7⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12013.exe
        8⤵
        
        PID:13680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17603.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44141.exe
        7⤵
        
        PID:15920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45923.exe
        7⤵
        
        PID:17720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36088.exe
        6⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51502.exe
        7⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13956.exe
        7⤵
        
        PID:11672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46636.exe
        7⤵
        
        PID:16020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2351.exe
        7⤵
        
        PID:6720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58968.exe
        6⤵
        
        PID:8532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35345.exe
        6⤵
        
        PID:12964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47204.exe
        6⤵
        
        PID:15568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7552.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63354.exe
        6⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40490.exe
        7⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41466.exe
        8⤵
        
        PID:9860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60476.exe
        8⤵
        
        PID:14980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15755.exe
        8⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27028.exe
        7⤵
        
        PID:9476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5499.exe
        7⤵
        
        PID:13992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64188.exe
        7⤵
        
        PID:7876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39072.exe
        6⤵
        
        PID:7680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17603.exe
        6⤵
        
        PID:10372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44376.exe
        6⤵
        
        PID:16440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        6⤵
        
        PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41656.exe
        5⤵
        
        PID:5868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53318.exe
        6⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65534.exe
        7⤵
        
        PID:11476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48085.exe
        7⤵
        
        PID:15780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52615.exe
        7⤵
        
        PID:8792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2908.exe
        6⤵
        
        PID:10412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16704.exe
        6⤵
        
        PID:17124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12326.exe
        6⤵
        
        PID:7796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43069.exe
        5⤵
        
        PID:8144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24891.exe
        5⤵
        
        PID:11736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27300.exe
        5⤵
        
        PID:15992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8793.exe
        5⤵
        
        PID:9508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52949.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19826.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33998.exe
        6⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25166.exe
        7⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16260.exe
        8⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24183.exe
        8⤵
        
        PID:12072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23529.exe
        8⤵
        
        PID:16172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19643.exe
        8⤵
        
        PID:7964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40188.exe
        7⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53282.exe
        8⤵
        
        PID:11308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8396.exe
        8⤵
        
        PID:15972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36471.exe
        8⤵
        
        PID:17828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27691.exe
        7⤵
        
        PID:11720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52501.exe
        7⤵
        
        PID:16080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45539.exe
        7⤵
        
        PID:18376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29228.exe
        6⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29280.exe
        7⤵
        
        PID:8508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58718.exe
        8⤵
        
        PID:13396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30519.exe
        8⤵
        
        PID:18400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57300.exe
        7⤵
        
        PID:12388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41401.exe
        7⤵
        
        PID:15472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23042.exe
        7⤵
        
        PID:6784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21443.exe
        6⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1925.exe
        7⤵
        
        PID:14228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18459.exe
        7⤵
        
        PID:17424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58445.exe
        6⤵
        
        PID:10368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52580.exe
        6⤵
        
        PID:13688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43071.exe
        6⤵
        
        PID:5980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65061.exe
        5⤵
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
        6⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64854.exe
        7⤵
        
        PID:9684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43512.exe
        7⤵
        
        PID:14188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41027.exe
        7⤵
        
        PID:6736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27028.exe
        6⤵
        
        PID:9632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14784.exe
        6⤵
        
        PID:15008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23426.exe
        6⤵
        
        PID:8640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52808.exe
        5⤵
        
        PID:7720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12065.exe
        6⤵
        
        PID:11752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1749.exe
        7⤵
        
        PID:17024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50540.exe
        6⤵
        
        PID:17188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23469.exe
        5⤵
        
        PID:10312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30772.exe
        5⤵
        
        PID:14276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57205.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34115.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64506.exe
        5⤵
        
        PID:5508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8009.exe
        6⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15758.exe
        7⤵
        
        PID:10764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7052.exe
        7⤵
        
        PID:15412
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15412 -s 464
        8⤵
        Program crash
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26226.exe
        7⤵
        
        PID:8264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15928.exe
        6⤵
        
        PID:11232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61820.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39212.exe
        6⤵
        
        PID:8316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64693.exe
        5⤵
        
        PID:3604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55314.exe
        6⤵
        
        PID:14000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62460.exe
        6⤵
        
        PID:17544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7140.exe
        5⤵
        
        PID:12816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22096.exe
        5⤵
        
        PID:8692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31185.exe
      4⤵
      PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25690.exe
        5⤵
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14221.exe
        6⤵
        
        PID:9420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59185.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21950.exe
        6⤵
        
        PID:1980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3676.exe
        5⤵
        
        PID:8428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61820.exe
        5⤵
        
        PID:15684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47489.exe
        5⤵
        
        PID:17592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63376.exe
      4⤵
      PID:6868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8356.exe
      4⤵
      PID:11636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3525.exe
      4⤵
      PID:15956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27890.exe
      4⤵
      PID:17784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60488.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60488.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7277.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56390.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54418.exe
        6⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25166.exe
        7⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48954.exe
        8⤵
        
        PID:8452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5625.exe
        9⤵
        
        PID:13612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7551.exe
        9⤵
        
        PID:8948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3300.exe
        8⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1903.exe
        8⤵
        
        PID:16576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54588.exe
        8⤵
        
        PID:17792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60941.exe
        7⤵
        
        PID:7208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31207.exe
        7⤵
        
        PID:12592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14987.exe
        7⤵
        
        PID:5220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53629.exe
        6⤵
        
        PID:7528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34760.exe
        7⤵
        
        PID:11104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46316.exe
        7⤵
        
        PID:13256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6635.exe
        6⤵
        
        PID:8292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42484.exe
        6⤵
        
        PID:15600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45145.exe
        6⤵
        
        PID:8648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52809.exe
        5⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47890.exe
        6⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44346.exe
        7⤵
        
        PID:10920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48085.exe
        7⤵
        
        PID:15804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19558.exe
        7⤵
        
        PID:18136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27028.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5499.exe
        6⤵
        
        PID:14512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14707.exe
        5⤵
        
        PID:6988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35610.exe
        6⤵
        
        PID:13148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1360.exe
        6⤵
        
        PID:1788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26785.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5735.exe
        5⤵
        
        PID:14880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62060.exe
        5⤵
        
        PID:18124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20380.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26598.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30786.exe
        6⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1289.exe
        7⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13772.exe
        7⤵
        
        PID:12940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62599.exe
        7⤵
        
        PID:6428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37936.exe
        6⤵
        
        PID:9780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25501.exe
        6⤵
        
        PID:14900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56675.exe
        6⤵
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25284.exe
        5⤵
        
        PID:800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57418.exe
        6⤵
        
        PID:10008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20785.exe
        7⤵
        
        PID:10192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52833.exe
        6⤵
        
        PID:12060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58515.exe
        6⤵
        
        PID:16488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33363.exe
        5⤵
        
        PID:7312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21992.exe
        5⤵
        
        PID:14704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42332.exe
        5⤵
        
        PID:18160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21235.exe
      4⤵
      PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16260.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18062.exe
        6⤵
        
        PID:12020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32516.exe
        6⤵
        
        PID:16204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52615.exe
        6⤵
        
        PID:9000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32543.exe
        5⤵
        
        PID:11244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36933.exe
        5⤵
        
        PID:16420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53987.exe
        5⤵
        
        PID:5976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6504.exe
      4⤵
      PID:6852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24891.exe
      4⤵
      PID:11764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27300.exe
      4⤵
      PID:16004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42841.exe
      4⤵
      PID:3112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28585.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28585.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63141.exe
      4⤵
      PID:4952
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 488
        5⤵
        Program crash
        
        PID:5368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7307.exe
      4⤵
      PID:6468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39878.exe
        5⤵
        
        PID:8396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48085.exe
        5⤵
        
        PID:15860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41624.exe
        5⤵
        
        PID:17532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23277.exe
      4⤵
      PID:6812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59020.exe
      4⤵
      PID:15728
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15728 -s 472
        5⤵
        Program crash
        
        PID:4684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14779.exe
      4⤵
      PID:17780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18487.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18487.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27750.exe
      4⤵
      PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47890.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3565.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34603.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27028.exe
        5⤵
        
        PID:9752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5499.exe
        5⤵
        
        PID:14504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30328.exe
      4⤵
      PID:7132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57418.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        5⤵
        
        PID:12344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16823.exe
        5⤵
        
        PID:2504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37640.exe
      4⤵
      PID:10028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8039.exe
      4⤵
      PID:17224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6891.exe
      4⤵
      PID:6556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5984.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5984.exe
    3⤵
    PID:5776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50106.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50337.exe
      4⤵
      PID:3508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54727.exe
      4⤵
      PID:9264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58234.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58234.exe
    3⤵
    PID:7732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59923.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59923.exe
    3⤵
    PID:11976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18499.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18499.exe
    3⤵
    PID:3040
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8356.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8356.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34802.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34802.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58450.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64646.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48222.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58886.exe
        7⤵
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12721.exe
        8⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49810.exe
        9⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15823.exe
        9⤵
        
        PID:10716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7576.exe
        9⤵
        
        PID:16520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20738.exe
        9⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19960.exe
        8⤵
        
        PID:7824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52580.exe
        8⤵
        
        PID:8484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4068.exe
        8⤵
        
        PID:16480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59031.exe
        8⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4619.exe
        7⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64854.exe
        8⤵
        
        PID:9568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43512.exe
        8⤵
        
        PID:14148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53855.exe
        8⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46629.exe
        7⤵
        
        PID:9428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2699.exe
        7⤵
        
        PID:13808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4644.exe
        7⤵
        
        PID:17492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31620.exe
        6⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49094.exe
        7⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37558.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37530.exe
        9⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3472.exe
        9⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61237.exe
        8⤵
        
        PID:10284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61820.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54588.exe
        8⤵
        
        PID:17732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7708.exe
        7⤵
        
        PID:8020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51318.exe
        8⤵
        
        PID:13868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36528.exe
        8⤵
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15692.exe
        7⤵
        
        PID:11632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54080.exe
        7⤵
        
        PID:15476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34987.exe
        6⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2996.exe
        7⤵
        
        PID:8808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22642.exe
        8⤵
        
        PID:12444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10244.exe
        8⤵
        
        PID:644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2811.exe
        7⤵
        
        PID:13120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22096.exe
        7⤵
        
        PID:1360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15004.exe
        6⤵
        
        PID:9148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28407.exe
        6⤵
        
        PID:12884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43071.exe
        6⤵
        
        PID:7236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40504.exe
        5⤵
        
        PID:3348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12721.exe
        6⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57402.exe
        7⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44346.exe
        8⤵
        
        PID:10980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48085.exe
        8⤵
        
        PID:15884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16522.exe
        8⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2908.exe
        7⤵
        
        PID:10404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22466.exe
        7⤵
        
        PID:5080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31636.exe
        6⤵
        
        PID:8100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58762.exe
        7⤵
        
        PID:10220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56533.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17399.exe
        7⤵
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57676.exe
        6⤵
        
        PID:10260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61708.exe
        6⤵
        
        PID:17220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12475.exe
        6⤵
        
        PID:18172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48829.exe
        5⤵
        
        PID:6376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50106.exe
        6⤵
        
        PID:8864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54613.exe
        6⤵
        
        PID:13284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47659.exe
        6⤵
        
        PID:9088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52032.exe
        5⤵
        
        PID:9380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3384.exe
        6⤵
        
        PID:6268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25852.exe
        5⤵
        
        PID:13880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16800.exe
        5⤵
        
        PID:3032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8984.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64558.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
        6⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4169.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16260.exe
        8⤵
        
        PID:8160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8749.exe
        9⤵
        
        PID:12844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52833.exe
        8⤵
        
        PID:13296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22087.exe
        8⤵
        
        PID:16488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16123.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27552.exe
        7⤵
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7140.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5931.exe
        7⤵
        
        PID:6808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9000.exe
        6⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2996.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27507.exe
        7⤵
        
        PID:13068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47468.exe
        7⤵
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9139.exe
        6⤵
        
        PID:9192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61577.exe
        6⤵
        
        PID:12684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56675.exe
        6⤵
        
        PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63909.exe
        5⤵
        
        PID:1396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24782.exe
        6⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-801.exe
        7⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41466.exe
        8⤵
        
        PID:9872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60476.exe
        8⤵
        
        PID:15012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3311.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43941.exe
        7⤵
        
        PID:10276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29531.exe
        7⤵
        
        PID:14208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29845.exe
        7⤵
        
        PID:17644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47676.exe
        6⤵
        
        PID:8684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47042.exe
        7⤵
        
        PID:14076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40119.exe
        7⤵
        
        PID:6092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16923.exe
        6⤵
        
        PID:13736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2916.exe
        6⤵
        
        PID:6792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64728.exe
        5⤵
        
        PID:6568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48954.exe
        6⤵
        
        PID:8444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17878.exe
        7⤵
        
        PID:13368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44972.exe
        7⤵
        
        PID:6324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23423.exe
        6⤵
        
        PID:12784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14411.exe
        6⤵
        
        PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61892.exe
        5⤵
        
        PID:10112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1924.exe
        5⤵
        
        PID:13428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16473.exe
        5⤵
        
        PID:1252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62704.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30682.exe
        5⤵
        
        PID:1868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
        6⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64854.exe
        7⤵
        
        PID:9672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43512.exe
        7⤵
        
        PID:14172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16330.exe
        7⤵
        
        PID:6824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27028.exe
        6⤵
        
        PID:9772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5499.exe
        6⤵
        
        PID:14528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61256.exe
        6⤵
        
        PID:8116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39072.exe
        5⤵
        
        PID:7672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16334.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48085.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15147.exe
        6⤵
        
        PID:9540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17603.exe
        5⤵
        
        PID:11320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31547.exe
        5⤵
        
        PID:15876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24400.exe
        5⤵
        
        PID:18420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27101.exe
      4⤵
      PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8585.exe
        5⤵
        
        PID:7080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6061.exe
        6⤵
        
        PID:12432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60089.exe
        7⤵
        
        PID:17464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17524.exe
        6⤵
        
        PID:17236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28390.exe
        6⤵
        
        PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7184.exe
        5⤵
        
        PID:10604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20787.exe
        5⤵
        
        PID:15420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49196.exe
        5⤵
        
        PID:1028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51124.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60874.exe
        5⤵
        
        PID:10708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
        5⤵
        
        PID:15740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16410.exe
        5⤵
        
        PID:8016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8356.exe
      4⤵
      PID:11644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31543.exe
      4⤵
      PID:3112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11803.exe
      4⤵
      PID:17476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20110.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20110.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11361.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19826.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46250.exe
        6⤵
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25166.exe
        7⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53230.exe
        8⤵
        
        PID:8492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43564.exe
        8⤵
        
        PID:12380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10839.exe
        8⤵
        
        PID:17076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42336.exe
        8⤵
        
        PID:17772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64692.exe
        7⤵
        
        PID:10120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27125.exe
        7⤵
        
        PID:13436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50972.exe
        7⤵
        
        PID:5588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54117.exe
        6⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40978.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23734.exe
        8⤵
        
        PID:10332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48085.exe
        8⤵
        
        PID:15836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12843.exe
        8⤵
        
        PID:17760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42928.exe
        7⤵
        
        PID:10252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55380.exe
        7⤵
        
        PID:14272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22388.exe
        7⤵
        
        PID:2780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9139.exe
        6⤵
        
        PID:9176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42964.exe
        6⤵
        
        PID:13604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6507.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10816.exe
        5⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63266.exe
        6⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26998.exe
        7⤵
        
        PID:8036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59073.exe
        7⤵
        
        PID:11664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46636.exe
        7⤵
        
        PID:16088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21920.exe
        7⤵
        
        PID:3704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45233.exe
        6⤵
        
        PID:8528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29479.exe
        6⤵
        
        PID:12972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8050.exe
        6⤵
        
        PID:7888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4811.exe
        5⤵
        
        PID:7084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61502.exe
        6⤵
        
        PID:9888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11659.exe
        6⤵
        
        PID:15024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52704.exe
        6⤵
        
        PID:6768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22124.exe
        5⤵
        
        PID:9408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55121.exe
        5⤵
        
        PID:14612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13588.exe
        5⤵
        
        PID:18116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60837.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15497.exe
        5⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10941.exe
        6⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49.exe
        7⤵
        
        PID:9900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11659.exe
        7⤵
        
        PID:15032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65340.exe
        7⤵
        
        PID:7572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2524.exe
        6⤵
        
        PID:9300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14784.exe
        6⤵
        
        PID:15224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44039.exe
        6⤵
        
        PID:7224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41812.exe
        5⤵
        
        PID:7024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6061.exe
        6⤵
        
        PID:12404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62641.exe
        6⤵
        
        PID:17188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20606.exe
        6⤵
        
        PID:8
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20919.exe
        5⤵
        
        PID:10592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26653.exe
        5⤵
        
        PID:15192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15258.exe
        5⤵
        
        PID:8328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25319.exe
      4⤵
      PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16260.exe
        5⤵
        
        PID:8132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61137.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24183.exe
        5⤵
        
        PID:12088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36741.exe
        5⤵
        
        PID:16268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45923.exe
        5⤵
        
        PID:17740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47153.exe
      4⤵
      PID:8176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29466.exe
        5⤵
        
        PID:14116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24891.exe
      4⤵
      PID:12160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36044.exe
      4⤵
      PID:15160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41165.exe
      4⤵
      PID:1480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22719.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22719.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64750.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63437.exe
        5⤵
        
        PID:6596
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6596 -s 632
        6⤵
        Program crash
        
        PID:8048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9139.exe
        5⤵
        
        PID:9208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61577.exe
        5⤵
        
        PID:12680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20219.exe
        5⤵
        
        PID:5292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15668.exe
      4⤵
      PID:5648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8585.exe
        5⤵
        
        PID:5812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37058.exe
        6⤵
        
        PID:14820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45740.exe
        6⤵
        
        PID:5604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49369.exe
        5⤵
        
        PID:10912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61820.exe
        5⤵
        
        PID:15708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37676.exe
        5⤵
        
        PID:18204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62093.exe
      4⤵
      PID:8724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43016.exe
      4⤵
      PID:13024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34519.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31237.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31237.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26598.exe
      4⤵
      PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
        5⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12553.exe
        6⤵
        
        PID:14768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45740.exe
        6⤵
        
        PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27028.exe
        5⤵
        
        PID:7940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5499.exe
        5⤵
        
        PID:14488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61256.exe
        5⤵
        
        PID:7328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39072.exe
      4⤵
      PID:7656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28010.exe
        5⤵
        
        PID:10904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48085.exe
        5⤵
        
        PID:15820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26802.exe
        5⤵
        
        PID:8248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17603.exe
      4⤵
      PID:10248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2148.exe
      4⤵
      PID:15716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17142.exe
      4⤵
      PID:4488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47024.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47024.exe
    3⤵
    PID:5844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65290.exe
      4⤵
      PID:8576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60369.exe
        5⤵
        
        PID:17604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32080.exe
      4⤵
      PID:13036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15463.exe
      4⤵
      PID:4944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33244.exe
      4⤵
      PID:8992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41168.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41168.exe
    3⤵
    PID:5720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15917.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15917.exe
    3⤵
    PID:10820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29203.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29203.exe
    3⤵
    PID:15648
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20503.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20503.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5165.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5165.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31974.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51346.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34190.exe
        6⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56530.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64714.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21962.exe
        9⤵
        
        PID:13468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40887.exe
        9⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33992.exe
        8⤵
        
        PID:11988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13579.exe
        8⤵
        
        PID:16144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37676.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:18192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2036.exe
        7⤵
        
        PID:8848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42500.exe
        7⤵
        
        PID:12000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18256.exe
        7⤵
        
        PID:16932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59799.exe
        7⤵
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-640.exe
        6⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7153.exe
        7⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35144.exe
        7⤵
        
        PID:10724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31067.exe
        7⤵
        
        PID:16428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38060.exe
        7⤵
        
        PID:8260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19855.exe
        6⤵
        
        PID:8872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3248.exe
        6⤵
        
        PID:11700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51081.exe
        5⤵
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56530.exe
        6⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62062.exe
        7⤵
        
        PID:7760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44538.exe
        8⤵
        
        PID:11196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48085.exe
        8⤵
        
        PID:15844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23979.exe
        8⤵
        
        PID:17516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45861.exe
        7⤵
        
        PID:9292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61820.exe
        7⤵
        
        PID:15660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37676.exe
        7⤵
        
        PID:18184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7708.exe
        6⤵
        
        PID:8196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52580.exe
        6⤵
        
        PID:11892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60861.exe
        6⤵
        
        PID:16548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41647.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2315.exe
        5⤵
        
        PID:6448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42794.exe
        6⤵
        
        PID:7784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49945.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61820.exe
        6⤵
        
        PID:15676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47489.exe
        6⤵
        
        PID:17480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45452.exe
        5⤵
        
        PID:8500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8172.exe
        5⤵
        
        PID:12956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20749.exe
        5⤵
        
        PID:7584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53053.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5409.exe
        5⤵
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56530.exe
        6⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45726.exe
        7⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57418.exe
        8⤵
        
        PID:9940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44332.exe
        8⤵
        
        PID:15084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23156.exe
        8⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23904.exe
        7⤵
        
        PID:10100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5537.exe
        8⤵
        
        PID:14800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51516.exe
        8⤵
        
        PID:1036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9111.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57364.exe
        7⤵
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31915.exe
        6⤵
        
        PID:8224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33373.exe
        6⤵
        
        PID:13132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40967.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5300.exe
        5⤵
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43718.exe
        6⤵
        
        PID:6860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47013.exe
        6⤵
        
        PID:9372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47212.exe
        6⤵
        
        PID:16316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49196.exe
        6⤵
        
        PID:6996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60696.exe
        5⤵
        
        PID:8280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33373.exe
        5⤵
        
        PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49576.exe
        5⤵
        
        PID:1168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48672.exe
      4⤵
      PID:3648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12913.exe
        5⤵
        
        PID:5988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59130.exe
        6⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65150.exe
        7⤵
        
        PID:10988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48085.exe
        7⤵
        
        PID:15852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10658.exe
        7⤵
        
        PID:17416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12996.exe
        6⤵
        
        PID:10840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61820.exe
        6⤵
        
        PID:15652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32092.exe
        6⤵
        
        PID:8320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7708.exe
        5⤵
        
        PID:8204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52580.exe
        5⤵
        
        PID:11372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61245.exe
        5⤵
        
        PID:14264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14599.exe
        5⤵
        
        PID:15888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42468.exe
      4⤵
      PID:6216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62654.exe
        5⤵
        
        PID:10080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44089.exe
        5⤵
        
        PID:13324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16522.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21428.exe
      4⤵
      PID:9444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3229.exe
      4⤵
      PID:13876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2234.exe
      4⤵
      PID:6616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36612.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36612.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63406.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33230.exe
        5⤵
        
        PID:116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44278.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13629.exe
        7⤵
        
        PID:7852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4828.exe
        7⤵
        
        PID:10864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61820.exe
        7⤵
        
        PID:15692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29845.exe
        7⤵
        
        PID:17504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60993.exe
        6⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52580.exe
        6⤵
        
        PID:10664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53077.exe
        6⤵
        
        PID:16324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45923.exe
        6⤵
        
        PID:17748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29804.exe
        5⤵
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16260.exe
        6⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35610.exe
        7⤵
        
        PID:13104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5143.exe
        7⤵
        
        PID:16088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24183.exe
        6⤵
        
        PID:12096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11276.exe
        6⤵
        
        PID:16188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41647.exe
        6⤵
        
        PID:17584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-639.exe
        5⤵
        
        PID:3332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48054.exe
        6⤵
        
        PID:11580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8459.exe
        6⤵
        
        PID:9112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33557.exe
        5⤵
        
        PID:12176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52580.exe
        5⤵
        
        PID:13620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57265.exe
        5⤵
        
        PID:9012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5196.exe
      4⤵
      PID:2076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56530.exe
        5⤵
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16260.exe
        6⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44346.exe
        7⤵
        
        PID:10952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48085.exe
        7⤵
        
        PID:15772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52807.exe
        7⤵
        
        PID:17952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52833.exe
        6⤵
        
        PID:13288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29575.exe
        6⤵
        
        PID:14276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47676.exe
        5⤵
        
        PID:8668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12249.exe
        6⤵
        
        PID:11836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11904.exe
        6⤵
        
        PID:16124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48339.exe
        6⤵
        
        PID:18388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51105.exe
        5⤵
        
        PID:12584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56628.exe
        5⤵
        
        PID:4048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27503.exe
        5⤵
        
        PID:7636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18459.exe
      4⤵
      PID:6232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13541.exe
        5⤵
        
        PID:9184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59294.exe
        6⤵
        
        PID:14108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1827.exe
        6⤵
        
        PID:5636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54229.exe
        5⤵
        
        PID:12788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26418.exe
        5⤵
        
        PID:7924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60697.exe
      4⤵
      PID:9388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28325.exe
        5⤵
        
        PID:9080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42388.exe
      4⤵
      PID:13860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31888.exe
      4⤵
      PID:7932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37048.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37048.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53385.exe
      4⤵
      PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55046.exe
        5⤵
        
        PID:7800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32862.exe
        6⤵
        
        PID:10936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48085.exe
        6⤵
        
        PID:15812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54919.exe
        6⤵
        
        PID:18396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62197.exe
        5⤵
        
        PID:10672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61820.exe
        5⤵
        
        PID:16252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4079.exe
        5⤵
        
        PID:8600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9191.exe
      4⤵
      PID:8032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60286.exe
        5⤵
        
        PID:6048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7027.exe
      4⤵
      PID:9164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3819.exe
      4⤵
      PID:4172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54537.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54537.exe
    3⤵
    PID:1720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-469.exe
      4⤵
      PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4501.exe
        5⤵
        
        PID:6956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33172.exe
        5⤵
        
        PID:8352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21002.exe
        6⤵
        
        PID:13328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61308.exe
        6⤵
        
        PID:6604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29095.exe
        5⤵
        
        PID:11780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24297.exe
        5⤵
        
        PID:16560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17806.exe
        5⤵
        
        PID:2656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52441.exe
      4⤵
      PID:6944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28890.exe
        5⤵
        
        PID:14804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7140.exe
      4⤵
      PID:12848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36591.exe
      4⤵
      PID:4420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65052.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65052.exe
    3⤵
    PID:6432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64854.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43512.exe
      4⤵
      PID:14164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16823.exe
      4⤵
      PID:5936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35496.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35496.exe
    3⤵
    PID:9400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63186.exe
      4⤵
      PID:14048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36528.exe
      4⤵
      PID:6656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42918.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42918.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:13840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38606.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38606.exe
    3⤵
    PID:7344
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39711.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39711.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24766.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24766.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15165.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19582.exe
        5⤵
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23386.exe
        6⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25986.exe
        7⤵
        
        PID:8880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49185.exe
        7⤵
        
        PID:8392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51452.exe
        7⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25616.exe
        7⤵
        
        PID:18412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59213.exe
        6⤵
        
        PID:8520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39761.exe
        6⤵
        
        PID:12792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38803.exe
        6⤵
        
        PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5824.exe
        5⤵
        
        PID:7148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39746.exe
        6⤵
        
        PID:14224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30000.exe
        6⤵
        
        PID:8152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29663.exe
        5⤵
        
        PID:11256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64412.exe
        5⤵
        
        PID:17024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6507.exe
        5⤵
        
        PID:1364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64869.exe
      4⤵
      PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4501.exe
        5⤵
        
        PID:6208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12368.exe
        5⤵
        
        PID:8556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33446.exe
        6⤵
        
        PID:12708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41183.exe
        6⤵
        
        PID:9316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53984.exe
        5⤵
        
        PID:12992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7090.exe
        5⤵
        
        PID:8252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8808.exe
      4⤵
      PID:8708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40070.exe
        5⤵
        
        PID:10392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48085.exe
        5⤵
        
        PID:15896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22827.exe
        5⤵
        
        PID:6576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16915.exe
      4⤵
      PID:9616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11732.exe
      4⤵
      PID:16412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56053.exe
      4⤵
      PID:9064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3468.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3468.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63354.exe
      4⤵
      PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22426.exe
        5⤵
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50106.exe
        6⤵
        
        PID:7316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50337.exe
        6⤵
        
        PID:12716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55116.exe
        6⤵
        
        PID:6188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42020.exe
        5⤵
        
        PID:9756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41872.exe
        5⤵
        
        PID:14284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29404.exe
        5⤵
        
        PID:13700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4864.exe
      4⤵
      PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65534.exe
        5⤵
        
        PID:11436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48085.exe
        5⤵
        
        PID:15756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36471.exe
        5⤵
        
        PID:17812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33363.exe
      4⤵
      PID:8048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21992.exe
      4⤵
      PID:14696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23426.exe
      4⤵
      PID:4392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25319.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25319.exe
    3⤵
    PID:5740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45726.exe
      4⤵
      PID:7484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5833.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61237.exe
      4⤵
      PID:10292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61820.exe
      4⤵
      PID:15700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42336.exe
      4⤵
      PID:17800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35477.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35477.exe
    3⤵
    PID:8076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42601.exe
      4⤵
      PID:18000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49780.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49780.exe
    3⤵
    PID:8616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36044.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36044.exe
    3⤵
    PID:14072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6297.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6297.exe
    3⤵
    PID:17468
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32171.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32171.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40246.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40246.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63354.exe
      4⤵
      PID:5168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
        5⤵
        
        PID:6152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41466.exe
        6⤵
        
        PID:9956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        6⤵
        
        PID:12352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17399.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27028.exe
        5⤵
        
        PID:9664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5499.exe
        5⤵
        
        PID:13984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24609.exe
        5⤵
        
        PID:1192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39072.exe
      4⤵
      PID:7648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24694.exe
        5⤵
        
        PID:11084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48085.exe
        5⤵
        
        PID:15796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36471.exe
        5⤵
        
        PID:17820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17603.exe
      4⤵
      PID:11292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47308.exe
      4⤵
      PID:1132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64452.exe
      4⤵
      PID:1008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7500.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7500.exe
    3⤵
    PID:5676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13629.exe
      4⤵
      PID:7860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8357.exe
        5⤵
        
        PID:10876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48085.exe
        5⤵
        
        PID:15748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41048.exe
        5⤵
        
        PID:17988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-315.exe
      4⤵
      PID:11948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55013.exe
      4⤵
      PID:16112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10982.exe
      4⤵
      PID:6664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9191.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9191.exe
    3⤵
    PID:7100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58333.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58333.exe
    3⤵
    PID:14016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18637.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18637.exe
    3⤵
    PID:5436
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63405.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63405.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54994.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54994.exe
    3⤵
    PID:708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56826.exe
      4⤵
      PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65150.exe
        5⤵
        
        PID:10968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48085.exe
        5⤵
        
        PID:15764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43331.exe
        5⤵
        
        PID:5228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35580.exe
      4⤵
      PID:9604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5499.exe
      4⤵
      PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4079.exe
      4⤵
      PID:8628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39264.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39264.exe
    3⤵
    PID:7816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16526.exe
      4⤵
      PID:10692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48085.exe
      4⤵
      PID:15876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25266.exe
      4⤵
      PID:7280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26731.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26731.exe
    3⤵
    PID:11608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36399.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36399.exe
    3⤵
    PID:3088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44415.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44415.exe
    3⤵
    PID:2724
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47554.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47554.exe
  2⤵
  PID:5836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8585.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8585.exe
    3⤵
    PID:1888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2745.exe
      4⤵
      PID:13056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42475.exe
      4⤵
      PID:9124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32648.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32648.exe
    3⤵
    PID:10856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20787.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20787.exe
    3⤵
    PID:15400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42144.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42144.exe
    3⤵
    PID:17624
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30123.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30123.exe
  2⤵
  PID:7180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15189.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15189.exe
    3⤵
    PID:12932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59475.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59475.exe
    3⤵
    PID:5272
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
  2⤵
  PID:11708
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21700.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21700.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:16028
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23929.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23929.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:9348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4952 -ip 4952
1⤵
PID:376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6596 -ip 6596
1⤵
PID:8616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 9996 -ip 9996
1⤵
PID:9292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 15728 -ip 15728
1⤵
PID:4484

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:10036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10001.exe

Filesize
468KB

MD5
48bb99a144ac48a8c9ce483af31c7f55

SHA1
3e8cd13cb85d846a9500b08f0126465dda294cdc

SHA256
9607acb47bf60d88f54a685ae38b1db76cbc0a6a347c87c575f969c73e0e0dee

SHA512
8195d5ae6c3e7f52b2bc7405072f05806e9901b27a3996f8a1f548612abaabd4d325b3499a7a168d353e2f989131c930bf5f5daa3bf3fdb3409f4ab428b39de9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11361.exe

Filesize
468KB

MD5
5ecd8660ccc1e4954099fe77731b8462

SHA1
c59d1aa07ad1bb490903994f01e4f55cf8780c0d

SHA256
6b2581d03a0dd66452ea932af2813a9c27c0e2e12097d24db73bdd42454b63a3

SHA512
598b581397bf92a99c86d07fa74f277dd7da6d10d25ff4cf0232234c8f87e72f178a1be1518f7f7de6ba3aed28256276c52cfdb792480768d40271858c895a68

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20110.exe

Filesize
468KB

MD5
ce3ab891c31af1c26ec23a2b3b401a4c

SHA1
00918ed34b200e6755355dd9606a5db214e0b5ae

SHA256
57cff3e50869d8fe25b8ec83c57849404f87a385ac44e91ef9028526a8c253e2

SHA512
26660c0ce67a6a27bb9492a5f7606e93c27ab635db67b5ac2b2aecb442601201f9ca04778652d24cd89b8f971813ea7901a1b7f51ffa6b3effcede72b62ae5b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20503.exe

Filesize
468KB

MD5
473aaaf70c8af88cc0d66b341d923421

SHA1
bacc0f34b24c7ef0167a8681631a4519357f96cb

SHA256
afa0865c40dc4098878ba79e5eed6a16fc086039ad432b6ff2e26a04faab2478

SHA512
4e8ceab26581a20c6a902d1fee90e88265e051cc118e8bff960c54acea4018bc63d695917a6cf1ec6572565e0fc0478b188784ac56ebe499693aab8ce8794dc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22719.exe

Filesize
468KB

MD5
638d8e26f270dcf821470db386c845e9

SHA1
ff87df06ccff689a98e722e08409e244ba1cbd02

SHA256
c11ec5c25498c9293ea81badf8ff3b7758f79b8b7170c1cd2816935b4c2d3cdd

SHA512
23443ce8ecc3a4bcafcd974c474f257c1ca69bd9a0ede74a445b2c12004acca1273b0b2e4e3f851d503c974fe5919fe5fa01b92b808d0e0afc2a6fdf45f00b34

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24447.exe

Filesize
468KB

MD5
a7af3203f69bb4854aa61efbc1c434da

SHA1
36179e3545ceb6bac226b8031fd47613c697ae87

SHA256
34e16c5890753e6d954937a7c343eeed488dfef553ca969eef57aa6736e5e658

SHA512
7f809485f19fca4a4f566a9ee4f61745f2c09191f24f16491cca5ea96d1842963e65d79eacc447295edbae7cd9fc647c1f40a9381403d5eaaf11698380827412

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24766.exe

Filesize
468KB

MD5
0b47824c9da3619d3180eba342f122f1

SHA1
0e8065f2ae7914770b6b71533b1b7d9b536c3cdf

SHA256
2c0dd587e34b7f013f3585c41cb127ebaca5d5dc602a2cef8261beaa2ac05e53

SHA512
168a4361ceb1d7f379f5a0ca05e09054f2e99d5ba7b0a50d7dce11c242ed621a26cd79a275d359ac43686e57b61bbae300dde555547f6337e25513709487172b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28222.exe

Filesize
468KB

MD5
a6a08fcd5dfe781f20f321c7e0d4f411

SHA1
42e9ddb174fb071ab03c4e691f8ad9779198648e

SHA256
813dbd902dca6f4f543720d49b231447aa4d77d17d5222ca1dc2b69a68420856

SHA512
b2407a8a848f282777aabcc4ca98c14d9bfffae6ad25fc543ed5cbaffad2374d71aa97407f1092e237c71d06ce74a13844cb39b68eba3074d6bd5200c9f7f29a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28585.exe

Filesize
468KB

MD5
057a7633a1d79d870ad6390c133ed4d3

SHA1
fd557fd040809522f7cda72b3ba429e7c3bf1db5

SHA256
b38503d6da60f87b6632dbbdd0582e89d1161b7c07352f92bb99fa05643014d6

SHA512
e700213c675492d3c0211e6e216ec13f6be47870d129d7cc961d5bca192a3dab9e4c38dde8c603572ba667d781a0cc5493be26c0f06957858518932937e7b082

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30416.exe

Filesize
468KB

MD5
f0da3f0725a1b98a3710c927b4760b98

SHA1
38eb8634482580d09196a4b4d56c1f93763c11c3

SHA256
cf46a7b89b073fb4da87927f53fbf870ada78876dba8cf16066f0dcf2b4d480e

SHA512
bb667bcd1f7ebc5c4b34f88d3aa73ab897c0605e4dbd8967e7e5ee69184e370228f9c9a6cccb12c8fa6a3cb1c9e8e3c2fd068a817c09c9f0ec0cc1232fb6ec5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30578.exe

Filesize
468KB

MD5
c5e4a609c3a5e71fc36bc00ce9b1a836

SHA1
9f86d7e40463c8363be01c5af3464a385f30719f

SHA256
7c3a34450f04b11ccd586423ae373c33f9163f9eca4764b3ea93319bbd05c09a

SHA512
36810f708fb1ff13073d9b357b56ed4bcd946cb6af9470605c5c58aae101fbe5514296959827a62d1e30430c5a0d5a8da1691decec7dcc4d38b71158f71af0e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31974.exe

Filesize
468KB

MD5
028680e1830b6a790afcd30736e2092f

SHA1
bbaa0d3a058ea61033029e8bdb7bba596fafc9e5

SHA256
30a6daa816ab30779b7c182cbebd4b4a12c90d8e9e742b2ca45265d8d78dd19a

SHA512
2c5ad487112c1d76e574ff76aefec353993e2815287b628fab8bb94819c1f081e79c071479a6a2ac585874a263ad2eefed9bcae5cec1d72e7c7766215c7e7f3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32171.exe

Filesize
468KB

MD5
72a476741787a1332248b6947f223af7

SHA1
c0f1fc2842f21d6eff9add3ea2dbe5de4e6b215b

SHA256
4cc95b08f23ec4999f91b98d3404d5692914ea3caa8fc41d663b887123a706db

SHA512
de914c36289cdfde804c9c9d5bab41d97469a0059c78f25c99d4428a3eb84c4720601cfe89b56b0aba0cd0d31e864da1e2a0ed2a074ea99c94bc57e8aaa09653

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34802.exe

Filesize
468KB

MD5
07006fef97d1687975494c102262d83e

SHA1
931d3a4d390af1f821dcf6de428c7be70e58231e

SHA256
6ba459c8c1f5c32d97acc2d6b67253dcd0d1cd9ffc603da640b7d967d14704c7

SHA512
373d41d422ea9765df1eb91460e19eb39a310726ff3c069b7997f4a73f5fad13a75953c04f4eadebc096dd4ea01d9d059a348960ff78166b19b2e55cbacd21c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36612.exe

Filesize
468KB

MD5
9b7ef2c0f5cd163f45afaa96758b8c36

SHA1
b60b2b537d34ea7ab33a936cb14b34aa1f1c8312

SHA256
6dbf74b574d2a0dace5492c2ed8be23f15fc2733c9feadc9bd5780357d8c10a9

SHA512
257a7d98848dcfbbeba8351cff2be434c8cf19c71fedb6071643d5ba30710926e461fa275e1aee4102fbf1e924c47f503a80e0d9f3ab1085e9130a55a395a826

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39711.exe

Filesize
468KB

MD5
d37c8ce72ebe24a2ef00313ddadba732

SHA1
a96107b3864d98431ec0f13b6aac91fc8f154d01

SHA256
a95a43b1ec1e1a1f199c2ad6a61ba47413da84822ca3bea0e4e8bd2c204f6fc9

SHA512
65bf8adb23f70b9e610fffb8ad8b8e11c1d4354970e114c1b2cac31d1f21663456cd98bb645de2c594571cc772f19e2623248763ff841e712aeea9d73151552d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40142.exe

Filesize
468KB

MD5
451aef25e151d1b2d841f628bd3702db

SHA1
f026fe060b7c78af8b91f66122eeb0312d8cbd06

SHA256
b51148af2f2879409184bf50f341ed4120db5dca301313560181469cd833b6c2

SHA512
60fa3c19e0a5e134cdcf99b5789bf216e42ff7b4137e4b485b200889452d9989e351d025e4a78fc01651ba99a269ead8e591bcb00b32a6a2719119b94063d866

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40888.exe

Filesize
468KB

MD5
65f781d9c55140423bd47938d1f13b26

SHA1
4b100571bfc6d122565ae05bb9ad31965c3f5428

SHA256
1cae45ef16b7787024c55bf23a77b8250b976005b6a80e10b76aad8f496c6879

SHA512
7421bc790647b238b719058021dcbb9a4f6b7aa3ca767bcb7bea2e03adeddb7e88d11c938ca07ece98c64f49a2ae8b6d0f09ce3da721cd4df7c111da2fb83a64

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46264.exe

Filesize
468KB

MD5
e6384181349656d20ab38ec425ee10bc

SHA1
700c5d7b8057b100494392afe839d307a72b36f7

SHA256
7cdf7666e220e1b87511990e47813a852fdd701913e1ff141047e4181ed13a7e

SHA512
a20a074b51ee27cd41cd9ae1157e859b9dd26c2ce8a992547da5a17e3a4d46056ebdc2ed477b2185434acf5f43caa447a31f865bbd454cf314598be3c82abf37

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50282.exe

Filesize
468KB

MD5
5590524ef2b1091058041d9cfcd7eceb

SHA1
61d12e5ac0b8842a6d7fa6c8d45193c44c4d2276

SHA256
41fa09abb800295d60c494553e1915c38bc7c32a461d3ccee69abfc49c1cd7b5

SHA512
629a980bc97b4af5003d96f81dec55b6d6fa29df673f0b13e26bf7d26df1623be697a0efe1cbed755d277f8c2b99dfb08df0279b148be583816127970b2b8108

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5165.exe

Filesize
468KB

MD5
34a89d912822b956f37197c6c2cf31c7

SHA1
e106f2ea80e7c605ef218f8b1da77f6b11bd18be

SHA256
51f46220d4b50d973cbc4b057b4f7ac1601d366f184b5f515432f8c2de439581

SHA512
598743cba81278258531e279236518f1ddb390ba7f3a7abf87d04858842960adcae4b3c5d10bc8919dcc94e8b50d74bd8d83a0cc523eaad7857c582bddabb54b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52949.exe

Filesize
468KB

MD5
6d3774f8bc0f8885cce0694e04bd6022

SHA1
7c3dd5b4b04abb2babf02082cfc635ed981958e1

SHA256
1957bf7487c7eb0865240080250cb1d09926506d213f64f4222220c4be589209

SHA512
16d51abb025c49ccd2ef6aba629857085adbdc9130eb9c742c3b1a5963c33c0ab4e74e4e9c512300584823cf816972d5f434c2f26d1fe5c945fbc04c297cf415

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58450.exe

Filesize
468KB

MD5
52a465c25d77ac026e17bd446d1891a2

SHA1
7cfa23d81e0f97e1be9e380468af34a9d7618749

SHA256
e2d910d3bcd59322b2900888dab131a9f22044ab8fa96a61ea6fc51ecb0b927f

SHA512
26f46cd02eb8a3fc238ae72490994a2004cf94ae087e08b588f68bd82fd1f4027659ee818735041eeac9eb53d8f25c2ed0f4cc59073f90fd23854672fb53e0bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60488.exe

Filesize
468KB

MD5
e1b0b57e4788c23756eb9c7fc47cca02

SHA1
e079c1e72eb8ed0a22d575ab0984b41605597ac6

SHA256
d485fdb8c91c63ff44144bc9b1ac90f145e6a970e34d1c43022a4ce35056c41f

SHA512
23bcef30ea08db8056ea93af7fb2e9e7b1c38b99353ce98a5a61b8cb7d1268d768ddbc049c2292f47677df820a517703a313529fbce8df74866a8bcd4833809f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60562.exe

Filesize
468KB

MD5
77924bd54ccdd0708003fffb2bc6de35

SHA1
2b18dd747d7b72a4028a10ae2d44e69ec9b00593

SHA256
a200721ecf2f8fc70d30763142037e5612f43fc3bf3813f18bc7088f8ea2be0c

SHA512
e5b91e1e5782138d69eea0fc6dcbe88793f39dbf4775c2c00e4fdfc1538c912c3d76c5a1472ec20e360d89fba8959d0e9696941eadadfbba9632d2ef47e6250d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64646.exe

Filesize
468KB

MD5
173d3c8a1420699b55dcffb0781a9dff

SHA1
03f174801ba93d713d50ab231f787e68da5d7ad2

SHA256
ab75ffaec2c61226808e223e1ccc3b5d7c0c555fb515b62eba21da6c510a30af

SHA512
2ab584821257eac32bae063b45e4111cbd1b5985dd52f42b4bd62fed42adf310b3693d2749fe186274fd4daa7adc15701b28f3f149aba2a322bc413bf27bfa2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6768.exe

Filesize
468KB

MD5
24046dd57cbd4251bfff5463e34be99f

SHA1
6a5cfc426369f0b0e7ed67cb745a955a862c1e9a

SHA256
57d5fd42394a3137d0339dc783b46fcf3f183619c2bc05da2dc5909d0248a0f9

SHA512
2ed89a0f88a9d47ae5e888c25d2d7996c5026370ff31dd6d4edc4f80956227f10de61093b07bf831f58911b4cb8c0e22c66338299f7225214c513ffad176728d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7277.exe

Filesize
468KB

MD5
d8bb316c7599a6e25aa271c0854a9630

SHA1
e80922aedc3be848a2c07eca0954fe8e5c59ebbf

SHA256
500afc9ba9f32e8c49bc809be54cc899253c59c5a1b0ffe36173f57dc2a0ddfa

SHA512
e41d1709765ef6ddfc2b45aa31baa68a217d9624f0e2e08ad3b015d26ce60f3c038825e2273f4870c54c38b9381ca99e63ee9191c08d6e4696f46dabb6db3086

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8356.exe

Filesize
468KB

MD5
9c6e9abde4c9f684553061c2ff0c304e

SHA1
25c5c27c2e9f55fa56a68c008a557ec47446f8b8

SHA256
2f285c09a0868e02e3a75070b426a2eb83bd6ef9ab2c2b04c3d3bc57d56a0af5

SHA512
c65cdadb2592d9997b5bb4edb06fce4ccf7545b79d1c65dfccb58b9a70842ea445045d0ef97d5b02174ee5f9c1688abad68464ce470e7de5bcda0840f70a81d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8396.exe

Filesize
468KB

MD5
f173ec897554793fa1777278618ba9b4

SHA1
ed14b88ed86d2c0fd30f508e11800b96a4387f37

SHA256
f40a703d3d749dc82be992696838eeb26333549d8dc621791d9a052f4c9d7893

SHA512
c7397b5b1b1edd2ab849504e26b3604fda7ddff92784ccf2327ee163b484a7ec28324a90a8bb9f68055effe60b6344dc1fabf7deb08425269d05c5dcc1eea552

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8984.exe

Filesize
468KB

MD5
b16a00c5e1a444fd2af302c73a9fdce5

SHA1
5f302a9c2d48f1aa23775b93fc32783c169a163b

SHA256
c8ec6e7f0266796a530ec819049b7b2a38664f223ad5e78f9ad0842c53bc6964

SHA512
401738f5f52b95927177e06589608d57e9a61708068b5aaa58ec42457b294995cfd4e464f4d1932f0391d486cac4a49e3e6f2c524f80fa0fa2146f80969d7075

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9581.exe

Filesize
468KB

MD5
f28aa7ac5d2987555ae3ca559f8e9f79

SHA1
7b390cc1e291123d5039c371f375a0be39cf2675

SHA256
e3600f1c0b5d8ab614ef0310e54ce8255b7d1a9c7985e6ecbfefa553231f8076

SHA512
827327ff6cc92822e84e259f3eefb2757540f03d7a5cc2d840b4baf7ab31099d2b1cbc363af3a44688e3c97c09b50182e90a64e1941d6a23d822a2be4b169abb

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads