7b84f0bf3c6533831013e98a02cc2a63b4fbbc787372d9bf01aa01c56a722ded

Analysis

max time kernel
120s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 16:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b84f0bf3c6533831013e98a02cc2a63b4fbbc787372d9bf01aa01c56a722dedN.exe
Size

468KB
MD5

b01410c8908608d09cd6aa7396e7f9a0
SHA1

5689c303e49648e31607d7671b4609332644d155
SHA256

7b84f0bf3c6533831013e98a02cc2a63b4fbbc787372d9bf01aa01c56a722ded
SHA512

6c6653da3202d14d77be81e0ddddf49267868f12db7c8ddda70f56af4804048ed0688eb71b3283494263bdc603ba51adad9fc0d005e6e184cd59a465f06ec2dd
SSDEEP

3072:6bFzogJEl0VBtgYtPzDjqf8uECnZZnppnmHh9VhPU4ZcNEaW11EI:6bFolYBtTPfjqfVpYRU4WCaW1

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3320	Unicorn-61515.exe
1716	Unicorn-18091.exe
620	Unicorn-6585.exe
4500	Unicorn-12418.exe
3860	Unicorn-14456.exe
3280	Unicorn-721.exe
2244	Unicorn-56310.exe
3904	Unicorn-48703.exe
2576	Unicorn-56606.exe
2204	Unicorn-56871.exe
3360	Unicorn-56871.exe
1220	Unicorn-49258.exe
4940	Unicorn-62993.exe
2528	Unicorn-31472.exe
2616	Unicorn-37603.exe
5072	Unicorn-46347.exe
3780	Unicorn-30757.exe
1736	Unicorn-17951.exe
2280	Unicorn-38371.exe
2988	Unicorn-38106.exe
1420	Unicorn-32240.exe
3148	Unicorn-46539.exe
3936	Unicorn-46539.exe
4720	Unicorn-42653.exe
1532	Unicorn-31717.exe
4392	Unicorn-20447.exe
4364	Unicorn-28350.exe
2352	Unicorn-28615.exe
3176	Unicorn-21001.exe
1676	Unicorn-12641.exe
2076	Unicorn-57971.exe
3716	Unicorn-47757.exe
1512	Unicorn-23252.exe
4432	Unicorn-13793.exe
1640	Unicorn-20831.exe
3460	Unicorn-40489.exe
4804	Unicorn-49419.exe
632	Unicorn-54250.exe
4496	Unicorn-8578.exe
4204	Unicorn-16747.exe
4084	Unicorn-56818.exe
2532	Unicorn-25107.exe
5064	Unicorn-31228.exe
4988	Unicorn-17493.exe
4732	Unicorn-17493.exe
1404	Unicorn-17493.exe
4004	Unicorn-33275.exe
4008	Unicorn-46451.exe
1956	Unicorn-42102.exe
1888	Unicorn-5802.exe
4600	Unicorn-2465.exe
4352	Unicorn-22331.exe
3316	Unicorn-30499.exe
804	Unicorn-28452.exe
4944	Unicorn-17484.exe
1868	Unicorn-18801.exe
4116	Unicorn-28121.exe
4284	Unicorn-43903.exe
4140	Unicorn-25520.exe
2080	Unicorn-48179.exe
4188	Unicorn-60166.exe
2984	Unicorn-3062.exe
2264	Unicorn-19591.exe
760	Unicorn-65262.exe

Program crash 8 IoCs

pid	pid_target	Process	procid_target
6152	5624	WerFault.exe	194
12536	8220	WerFault.exe	364
16888	14476	WerFault.exe	757
16908	15180	WerFault.exe	719
17052	14360	WerFault.exe	750
21308	4492	Process not Found	895
9748	17812	Process not Found	930
9316	18472	Process not Found	979

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32030.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18749.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13446.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59819.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11978.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28121.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41023.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28764.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55563.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62634.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34640.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6938.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56880.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61114.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42279.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23196.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49044.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1799.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62382.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3358.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36273.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26458.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38379.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62993.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33239.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41068.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15899.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18718.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24251.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59466.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43758.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31719.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50146.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32850.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47790.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43357.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60182.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46451.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33460.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3839.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20447.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7525.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20150.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34339.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37479.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61759.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57338.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49575.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25071.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43425.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63026.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33810.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44943.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36045.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	3744	dwm.exe
Token: SeChangeNotifyPrivilege	3744	dwm.exe
Token: 33	3744	dwm.exe
Token: SeIncBasePriorityPrivilege	3744	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2908	7b84f0bf3c6533831013e98a02cc2a63b4fbbc787372d9bf01aa01c56a722dedN.exe
3320	Unicorn-61515.exe
1716	Unicorn-18091.exe
620	Unicorn-6585.exe
3860	Unicorn-14456.exe
3280	Unicorn-721.exe
4500	Unicorn-12418.exe
2244	Unicorn-56310.exe
1220	Unicorn-49258.exe
3904	Unicorn-48703.exe
4940	Unicorn-62993.exe
2576	Unicorn-56606.exe
2204	Unicorn-56871.exe
3360	Unicorn-56871.exe
2528	Unicorn-31472.exe
2616	Unicorn-37603.exe
5072	Unicorn-46347.exe
3780	Unicorn-30757.exe
1736	Unicorn-17951.exe
3148	Unicorn-46539.exe
2988	Unicorn-38106.exe
1532	Unicorn-31717.exe
2280	Unicorn-38371.exe
1420	Unicorn-32240.exe
4720	Unicorn-42653.exe
3936	Unicorn-46539.exe
4392	Unicorn-20447.exe
2352	Unicorn-28615.exe
3176	Unicorn-21001.exe
4364	Unicorn-28350.exe
1676	Unicorn-12641.exe
2076	Unicorn-57971.exe
3716	Unicorn-47757.exe
1512	Unicorn-23252.exe
4432	Unicorn-13793.exe
1640	Unicorn-20831.exe
3460	Unicorn-40489.exe
4804	Unicorn-49419.exe
4496	Unicorn-8578.exe
4204	Unicorn-16747.exe
4008	Unicorn-46451.exe
1956	Unicorn-42102.exe
4988	Unicorn-17493.exe
2532	Unicorn-25107.exe
4084	Unicorn-56818.exe
1404	Unicorn-17493.exe
4004	Unicorn-33275.exe
5064	Unicorn-31228.exe
632	Unicorn-54250.exe
4732	Unicorn-17493.exe
1888	Unicorn-5802.exe
4600	Unicorn-2465.exe
3316	Unicorn-30499.exe
4352	Unicorn-22331.exe
4944	Unicorn-17484.exe
804	Unicorn-28452.exe
1868	Unicorn-18801.exe
4116	Unicorn-28121.exe
4284	Unicorn-43903.exe
4140	Unicorn-25520.exe
2080	Unicorn-48179.exe
2984	Unicorn-3062.exe
4188	Unicorn-60166.exe
2264	Unicorn-19591.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 3320	2908	7b84f0bf3c6533831013e98a02cc2a63b4fbbc787372d9bf01aa01c56a722dedN.exe	82
PID 2908 wrote to memory of 3320	2908	7b84f0bf3c6533831013e98a02cc2a63b4fbbc787372d9bf01aa01c56a722dedN.exe	82
PID 2908 wrote to memory of 3320	2908	7b84f0bf3c6533831013e98a02cc2a63b4fbbc787372d9bf01aa01c56a722dedN.exe	82
PID 3320 wrote to memory of 1716	3320	Unicorn-61515.exe	85
PID 3320 wrote to memory of 1716	3320	Unicorn-61515.exe	85
PID 3320 wrote to memory of 1716	3320	Unicorn-61515.exe	85
PID 2908 wrote to memory of 620	2908	7b84f0bf3c6533831013e98a02cc2a63b4fbbc787372d9bf01aa01c56a722dedN.exe	86
PID 2908 wrote to memory of 620	2908	7b84f0bf3c6533831013e98a02cc2a63b4fbbc787372d9bf01aa01c56a722dedN.exe	86
PID 2908 wrote to memory of 620	2908	7b84f0bf3c6533831013e98a02cc2a63b4fbbc787372d9bf01aa01c56a722dedN.exe	86
PID 620 wrote to memory of 4500	620	Unicorn-6585.exe	89
PID 620 wrote to memory of 4500	620	Unicorn-6585.exe	89
PID 620 wrote to memory of 4500	620	Unicorn-6585.exe	89
PID 2908 wrote to memory of 3860	2908	7b84f0bf3c6533831013e98a02cc2a63b4fbbc787372d9bf01aa01c56a722dedN.exe	90
PID 2908 wrote to memory of 3860	2908	7b84f0bf3c6533831013e98a02cc2a63b4fbbc787372d9bf01aa01c56a722dedN.exe	90
PID 2908 wrote to memory of 3860	2908	7b84f0bf3c6533831013e98a02cc2a63b4fbbc787372d9bf01aa01c56a722dedN.exe	90
PID 3320 wrote to memory of 3280	3320	Unicorn-61515.exe	91
PID 3320 wrote to memory of 3280	3320	Unicorn-61515.exe	91
PID 3320 wrote to memory of 3280	3320	Unicorn-61515.exe	91
PID 1716 wrote to memory of 2244	1716	Unicorn-18091.exe	93
PID 1716 wrote to memory of 2244	1716	Unicorn-18091.exe	93
PID 1716 wrote to memory of 2244	1716	Unicorn-18091.exe	93
PID 3280 wrote to memory of 3904	3280	Unicorn-721.exe	96
PID 3280 wrote to memory of 3904	3280	Unicorn-721.exe	96
PID 3280 wrote to memory of 3904	3280	Unicorn-721.exe	96
PID 2908 wrote to memory of 2576	2908	7b84f0bf3c6533831013e98a02cc2a63b4fbbc787372d9bf01aa01c56a722dedN.exe	97
PID 2908 wrote to memory of 2576	2908	7b84f0bf3c6533831013e98a02cc2a63b4fbbc787372d9bf01aa01c56a722dedN.exe	97
PID 2908 wrote to memory of 2576	2908	7b84f0bf3c6533831013e98a02cc2a63b4fbbc787372d9bf01aa01c56a722dedN.exe	97
PID 3860 wrote to memory of 3360	3860	Unicorn-14456.exe	99
PID 3860 wrote to memory of 3360	3860	Unicorn-14456.exe	99
PID 3860 wrote to memory of 3360	3860	Unicorn-14456.exe	99
PID 4500 wrote to memory of 2204	4500	Unicorn-12418.exe	98
PID 4500 wrote to memory of 2204	4500	Unicorn-12418.exe	98
PID 4500 wrote to memory of 2204	4500	Unicorn-12418.exe	98
PID 620 wrote to memory of 1220	620	Unicorn-6585.exe	100
PID 620 wrote to memory of 1220	620	Unicorn-6585.exe	100
PID 620 wrote to memory of 1220	620	Unicorn-6585.exe	100
PID 3320 wrote to memory of 4940	3320	Unicorn-61515.exe	101
PID 3320 wrote to memory of 4940	3320	Unicorn-61515.exe	101
PID 3320 wrote to memory of 4940	3320	Unicorn-61515.exe	101
PID 1716 wrote to memory of 2528	1716	Unicorn-18091.exe	102
PID 1716 wrote to memory of 2528	1716	Unicorn-18091.exe	102
PID 1716 wrote to memory of 2528	1716	Unicorn-18091.exe	102
PID 2244 wrote to memory of 2616	2244	Unicorn-56310.exe	103
PID 2244 wrote to memory of 2616	2244	Unicorn-56310.exe	103
PID 2244 wrote to memory of 2616	2244	Unicorn-56310.exe	103
PID 3904 wrote to memory of 5072	3904	Unicorn-48703.exe	104
PID 3904 wrote to memory of 5072	3904	Unicorn-48703.exe	104
PID 3904 wrote to memory of 5072	3904	Unicorn-48703.exe	104
PID 3280 wrote to memory of 3780	3280	Unicorn-721.exe	105
PID 3280 wrote to memory of 3780	3280	Unicorn-721.exe	105
PID 3280 wrote to memory of 3780	3280	Unicorn-721.exe	105
PID 4940 wrote to memory of 1736	4940	Unicorn-62993.exe	106
PID 4940 wrote to memory of 1736	4940	Unicorn-62993.exe	106
PID 4940 wrote to memory of 1736	4940	Unicorn-62993.exe	106
PID 2204 wrote to memory of 2280	2204	Unicorn-56871.exe	108
PID 2204 wrote to memory of 2280	2204	Unicorn-56871.exe	108
PID 2204 wrote to memory of 2280	2204	Unicorn-56871.exe	108
PID 3320 wrote to memory of 2988	3320	Unicorn-61515.exe	107
PID 3320 wrote to memory of 2988	3320	Unicorn-61515.exe	107
PID 3320 wrote to memory of 2988	3320	Unicorn-61515.exe	107
PID 620 wrote to memory of 1420	620	Unicorn-6585.exe	109
PID 620 wrote to memory of 1420	620	Unicorn-6585.exe	109
PID 620 wrote to memory of 1420	620	Unicorn-6585.exe	109
PID 3360 wrote to memory of 3148	3360	Unicorn-56871.exe	110

C:\Users\Admin\AppData\Local\Temp\7b84f0bf3c6533831013e98a02cc2a63b4fbbc787372d9bf01aa01c56a722dedN.exe
"C:\Users\Admin\AppData\Local\Temp\7b84f0bf3c6533831013e98a02cc2a63b4fbbc787372d9bf01aa01c56a722dedN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61515.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61515.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18091.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18091.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56310.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37603.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28615.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30499.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49414.exe
        8⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1822.exe
        9⤵
        
        PID:9780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe
        9⤵
        
        PID:15328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43947.exe
        9⤵
        
        PID:18592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62189.exe
        8⤵
        
        PID:10244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
        8⤵
        
        PID:15216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8282.exe
        8⤵
        
        PID:18640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19133.exe
        7⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53659.exe
        8⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48993.exe
        8⤵
        
        PID:13136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20263.exe
        8⤵
        
        PID:17876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33460.exe
        7⤵
        
        PID:8816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63026.exe
        7⤵
        
        PID:13056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2138.exe
        7⤵
        
        PID:19496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18801.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45823.exe
        7⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21231.exe
        8⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18543.exe
        9⤵
        
        PID:10048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe
        9⤵
        
        PID:13720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8197.exe
        9⤵
        
        PID:8772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33425.exe
        8⤵
        
        PID:11204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54813.exe
        8⤵
        
        PID:13020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13870.exe
        8⤵
        
        PID:9272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12989.exe
        7⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25227.exe
        8⤵
        
        PID:11724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56740.exe
        8⤵
        
        PID:19588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62677.exe
        7⤵
        
        PID:12256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54814.exe
        7⤵
        
        PID:17168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32402.exe
        7⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11296.exe
        6⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36799.exe
        7⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59819.exe
        8⤵
        
        PID:8736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39341.exe
        8⤵
        
        PID:13288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29302.exe
        8⤵
        
        PID:8252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30005.exe
        7⤵
        
        PID:10172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14732.exe
        7⤵
        
        PID:13564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57980.exe
        7⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26778.exe
        6⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42279.exe
        7⤵
        
        PID:9904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49901.exe
        7⤵
        
        PID:14476
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14476 -s 468
        8⤵
        Program crash
        
        PID:16888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64088.exe
        7⤵
        
        PID:19936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27448.exe
        6⤵
        
        PID:10892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42625.exe
        6⤵
        
        PID:15984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2668.exe
        6⤵
        
        PID:19896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21001.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4769.exe
        6⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27021.exe
        7⤵
        
        PID:7208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41703.exe
        8⤵
        
        PID:8644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37457.exe
        8⤵
        
        PID:13692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53320.exe
        8⤵
        
        PID:18372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26164.exe
        7⤵
        
        PID:10928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2289.exe
        7⤵
        
        PID:15968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37062.exe
        7⤵
        
        PID:7376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54213.exe
        6⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45787.exe
        7⤵
        
        PID:8824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9165.exe
        7⤵
        
        PID:14364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53231.exe
        7⤵
        
        PID:8440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35382.exe
        6⤵
        
        PID:10308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61517.exe
        6⤵
        
        PID:7904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63527.exe
        6⤵
        
        PID:9452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42315.exe
        6⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3358.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28019.exe
        8⤵
        
        PID:10740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29104.exe
        8⤵
        
        PID:17308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39709.exe
        7⤵
        
        PID:10480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16844.exe
        7⤵
        
        PID:15788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64420.exe
        7⤵
        
        PID:1732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21017.exe
        6⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64095.exe
        7⤵
        
        PID:8684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46379.exe
        8⤵
        
        PID:12496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35257.exe
        7⤵
        
        PID:13548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55993.exe
        6⤵
        
        PID:10152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20597.exe
        6⤵
        
        PID:13036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61759.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:19548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34458.exe
        5⤵
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40883.exe
        6⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47567.exe
        7⤵
        
        PID:8652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15029.exe
        7⤵
        
        PID:12936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8581.exe
        7⤵
        
        PID:19556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30005.exe
        6⤵
        
        PID:10116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43322.exe
        6⤵
        
        PID:15200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59839.exe
        6⤵
        
        PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34640.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42279.exe
        6⤵
        
        PID:9924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37457.exe
        6⤵
        
        PID:13968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4695.exe
        6⤵
        
        PID:18424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6829.exe
        5⤵
        
        PID:10920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59691.exe
        5⤵
        
        PID:15940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46674.exe
        5⤵
        
        PID:19484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31472.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20447.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5802.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20551.exe
        7⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39923.exe
        8⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58859.exe
        9⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48157.exe
        10⤵
        
        PID:17100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8869.exe
        9⤵
        
        PID:11732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58363.exe
        9⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3092.exe
        8⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32850.exe
        8⤵
        
        PID:14424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20150.exe
        8⤵
        
        PID:18004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57198.exe
        7⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42663.exe
        8⤵
        
        PID:9536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe
        8⤵
        
        PID:13336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30838.exe
        8⤵
        
        PID:8468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53445.exe
        7⤵
        
        PID:10472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22710.exe
        7⤵
        
        PID:15844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47395.exe
        7⤵
        
        PID:2380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21105.exe
        6⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27021.exe
        7⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29363.exe
        8⤵
        
        PID:11396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37761.exe
        8⤵
        
        PID:16600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-994.exe
        8⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31018.exe
        7⤵
        
        PID:11928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46149.exe
        7⤵
        
        PID:17140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53200.exe
        7⤵
        
        PID:18512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62382.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42663.exe
        7⤵
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60212.exe
        8⤵
        
        PID:9464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18293.exe
        7⤵
        
        PID:13616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43371.exe
        7⤵
        
        PID:18072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40469.exe
        6⤵
        
        PID:9828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55514.exe
        6⤵
        
        PID:12060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62289.exe
        6⤵
        
        PID:19652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2465.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9258.exe
        6⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44007.exe
        7⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55543.exe
        8⤵
        
        PID:8240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-914.exe
        9⤵
        
        PID:12308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62116.exe
        9⤵
        
        PID:17552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9445.exe
        8⤵
        
        PID:12240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13630.exe
        8⤵
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42065.exe
        7⤵
        
        PID:9344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50337.exe
        7⤵
        
        PID:13904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53320.exe
        7⤵
        
        PID:3208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57198.exe
        6⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59575.exe
        7⤵
        
        PID:10596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3109.exe
        7⤵
        
        PID:15804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29634.exe
        7⤵
        
        PID:20076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53445.exe
        6⤵
        
        PID:10516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22710.exe
        6⤵
        
        PID:15888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64691.exe
        6⤵
        
        PID:18224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48437.exe
        5⤵
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11526.exe
        6⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
        7⤵
        
        PID:8472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-944.exe
        7⤵
        
        PID:13752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62256.exe
        7⤵
        
        PID:1292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60461.exe
        6⤵
        
        PID:9208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32850.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6746.exe
        6⤵
        
        PID:3932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36534.exe
        5⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22243.exe
        6⤵
        
        PID:10084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe
        6⤵
        
        PID:12684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11274.exe
        6⤵
        
        PID:19580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62226.exe
        5⤵
        
        PID:11632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38106.exe
        5⤵
        
        PID:17148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28350.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22331.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45823.exe
        6⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13446.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20021.exe
        8⤵
        
        PID:11140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61961.exe
        8⤵
        
        PID:16360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59096.exe
        8⤵
        
        PID:8332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61333.exe
        7⤵
        
        PID:11676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55755.exe
        7⤵
        
        PID:3772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57338.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33447.exe
        7⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61114.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53999.exe
        7⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40337.exe
        6⤵
        
        PID:11820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54814.exe
        6⤵
        
        PID:17176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5397.exe
        6⤵
        
        PID:19884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63098.exe
        5⤵
        
        PID:5624
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5624 -s 464
        6⤵
        Program crash
        
        PID:6152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1556.exe
        5⤵
        
        PID:8576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54858.exe
        5⤵
        
        PID:12680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64883.exe
        5⤵
        
        PID:17712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17484.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65453.exe
        5⤵
        
        PID:7232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51791.exe
        6⤵
        
        PID:10076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9549.exe
        6⤵
        
        PID:13976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26458.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4017.exe
        5⤵
        
        PID:11260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52013.exe
        5⤵
        
        PID:15236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55556.exe
        5⤵
        
        PID:3192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13533.exe
      4⤵
      PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35869.exe
        5⤵
        
        PID:8620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28764.exe
        5⤵
        
        PID:12904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18718.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51419.exe
      4⤵
      PID:8596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4964.exe
      4⤵
      PID:12968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26295.exe
      4⤵
      PID:17736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-721.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-721.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48703.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46347.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28121.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21319.exe
        7⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4318.exe
        8⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14650.exe
        9⤵
        
        PID:10552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3109.exe
        9⤵
        
        PID:16136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11082.exe
        9⤵
        
        PID:18664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16024.exe
        8⤵
        
        PID:11620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6938.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62050.exe
        7⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59819.exe
        8⤵
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43425.exe
        8⤵
        
        PID:12692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51539.exe
        8⤵
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43741.exe
        7⤵
        
        PID:10124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20597.exe
        7⤵
        
        PID:14400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53591.exe
        7⤵
        
        PID:7524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32868.exe
        6⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50011.exe
        7⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24127.exe
        8⤵
        
        PID:10868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60900.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31940.exe
        8⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41017.exe
        7⤵
        
        PID:10824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61961.exe
        7⤵
        
        PID:16012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4695.exe
        7⤵
        
        PID:17608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21541.exe
        6⤵
        
        PID:7296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17775.exe
        7⤵
        
        PID:10008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-997.exe
        7⤵
        
        PID:14564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18482.exe
        7⤵
        
        PID:18012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52145.exe
        6⤵
        
        PID:10976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42625.exe
        6⤵
        
        PID:16024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-836.exe
        6⤵
        
        PID:19628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13793.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51687.exe
        6⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54074.exe
        7⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59435.exe
        8⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53602.exe
        8⤵
        
        PID:12068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17714.exe
        8⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43357.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43758.exe
        7⤵
        
        PID:13864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47395.exe
        7⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18749.exe
        6⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29155.exe
        7⤵
        
        PID:7744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59575.exe
        8⤵
        
        PID:10492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52118.exe
        8⤵
        
        PID:15716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28617.exe
        8⤵
        
        PID:19832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9305.exe
        7⤵
        
        PID:10776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9312.exe
        7⤵
        
        PID:16084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23196.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8956.exe
        6⤵
        
        PID:9172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63026.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41147.exe
        6⤵
        
        PID:18712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57809.exe
        5⤵
        
        PID:1952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18387.exe
        6⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32715.exe
        7⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47567.exe
        8⤵
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35257.exe
        8⤵
        
        PID:13556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11274.exe
        8⤵
        
        PID:19952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30005.exe
        7⤵
        
        PID:10188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43322.exe
        7⤵
        
        PID:14464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27270.exe
        7⤵
        
        PID:3224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7177.exe
        6⤵
        
        PID:7496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45787.exe
        7⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49901.exe
        7⤵
        
        PID:15196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41068.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17420.exe
        6⤵
        
        PID:11060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2289.exe
        6⤵
        
        PID:15916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-306.exe
        6⤵
        
        PID:19616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38350.exe
        5⤵
        
        PID:468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4349.exe
        6⤵
        
        PID:8152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48993.exe
        6⤵
        
        PID:13444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62256.exe
        6⤵
        
        PID:7704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46997.exe
        5⤵
        
        PID:8920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3910.exe
        5⤵
        
        PID:14712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6846.exe
        5⤵
        
        PID:8916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30757.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30757.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3062.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34723.exe
        7⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58179.exe
        8⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42279.exe
        9⤵
        
        PID:9912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5081.exe
        9⤵
        
        PID:14480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61141.exe
        8⤵
        
        PID:11552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44534.exe
        8⤵
        
        PID:16760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55563.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7177.exe
        7⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59575.exe
        8⤵
        
        PID:10568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3109.exe
        8⤵
        
        PID:16160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21518.exe
        8⤵
        
        PID:9496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46969.exe
        7⤵
        
        PID:10428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15177.exe
        7⤵
        
        PID:15820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28894.exe
        7⤵
        
        PID:18688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60742.exe
        6⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41023.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59575.exe
        8⤵
        
        PID:10588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3109.exe
        8⤵
        
        PID:15860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41254.exe
        8⤵
        
        PID:8788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25344.exe
        7⤵
        
        PID:10772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3159.exe
        7⤵
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37161.exe
        6⤵
        
        PID:7648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36903.exe
        7⤵
        
        PID:11584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32375.exe
        7⤵
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19917.exe
        6⤵
        
        PID:12236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4390.exe
        6⤵
        
        PID:19776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65262.exe
        5⤵
        Executes dropped EXE
        
        PID:760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54074.exe
        6⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53955.exe
        7⤵
        
        PID:10068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25620.exe
        8⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37457.exe
        7⤵
        
        PID:13492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31556.exe
        7⤵
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54753.exe
        6⤵
        
        PID:10784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2289.exe
        6⤵
        
        PID:16112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56715.exe
        6⤵
        
        PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32484.exe
        5⤵
        
        PID:3272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-374.exe
        6⤵
        
        PID:7752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19991.exe
        7⤵
        
        PID:11960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19873.exe
        7⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20789.exe
        6⤵
        
        PID:14592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6938.exe
        6⤵
        
        PID:1976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55662.exe
        5⤵
        
        PID:8976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54361.exe
        5⤵
        
        PID:13364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1799.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:19680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23252.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19591.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33763.exe
        6⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21231.exe
        7⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59819.exe
        8⤵
        
        PID:8716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43425.exe
        8⤵
        
        PID:12696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52115.exe
        8⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30005.exe
        7⤵
        
        PID:10180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18816.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65380.exe
        7⤵
        
        PID:17052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12989.exe
        6⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41703.exe
        7⤵
        
        PID:8672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37457.exe
        7⤵
        
        PID:13748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20263.exe
        7⤵
        
        PID:17800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54945.exe
        6⤵
        
        PID:10988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2289.exe
        6⤵
        
        PID:16104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8282.exe
        6⤵
        
        PID:18572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18749.exe
        5⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33239.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29171.exe
        7⤵
        
        PID:10792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61114.exe
        7⤵
        
        PID:16332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5078.exe
        7⤵
        
        PID:1884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7525.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33318.exe
        6⤵
        
        PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17124.exe
        5⤵
        
        PID:7448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1573.exe
        5⤵
        
        PID:10392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48739.exe
        5⤵
        
        PID:3588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39746.exe
      4⤵
      PID:3276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54074.exe
        5⤵
        
        PID:6880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23063.exe
        6⤵
        
        PID:9060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43425.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54575.exe
        6⤵
        
        PID:20060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48017.exe
        5⤵
        
        PID:8840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61630.exe
        5⤵
        
        PID:14536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14914.exe
        5⤵
        
        PID:2700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29684.exe
      4⤵
      PID:4828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59435.exe
        5⤵
        
        PID:6444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53602.exe
        5⤵
        
        PID:12136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25690.exe
        5⤵
        
        PID:212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36273.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5690.exe
      4⤵
      PID:7976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31630.exe
      4⤵
      PID:17632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62993.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62993.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17951.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52434.exe
        5⤵
        
        PID:2096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34339.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35869.exe
        7⤵
        
        PID:8608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24680.exe
        7⤵
        
        PID:12880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4695.exe
        7⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47790.exe
        6⤵
        
        PID:10412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6512.exe
        6⤵
        
        PID:15868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57476.exe
        6⤵
        
        PID:19644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe
        5⤵
        
        PID:5276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29155.exe
        6⤵
        
        PID:7352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31719.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48226.exe
        7⤵
        
        PID:16056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50491.exe
        7⤵
        
        PID:19508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59466.exe
        6⤵
        
        PID:11864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48949.exe
        6⤵
        
        PID:17192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13486.exe
        6⤵
        
        PID:6224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2569.exe
        5⤵
        
        PID:9004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54361.exe
        5⤵
        
        PID:13244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15483.exe
        5⤵
        
        PID:18248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17493.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56731.exe
        5⤵
        
        PID:968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10410.exe
        6⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49575.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58195.exe
        8⤵
        
        PID:14060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8442.exe
        8⤵
        
        PID:9836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25013.exe
        7⤵
        
        PID:11672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21409.exe
        7⤵
        
        PID:1764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19393.exe
        6⤵
        
        PID:11188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52013.exe
        6⤵
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6350.exe
        6⤵
        
        PID:8828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60985.exe
        5⤵
        
        PID:440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46363.exe
        6⤵
        
        PID:9944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10582.exe
        7⤵
        
        PID:12388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56880.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37457.exe
        6⤵
        
        PID:13872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31556.exe
        6⤵
        
        PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32030.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65413.exe
        5⤵
        
        PID:17608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49549.exe
        5⤵
        
        PID:8212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13844.exe
      4⤵
      PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39923.exe
        5⤵
        
        PID:6392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41105.exe
        6⤵
        
        PID:8256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44457.exe
        7⤵
        
        PID:16804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48993.exe
        6⤵
        
        PID:13412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3839.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:20400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15344.exe
        5⤵
        
        PID:8228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10582.exe
        6⤵
        
        PID:12432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56880.exe
        6⤵
        
        PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32850.exe
        5⤵
        
        PID:14416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10830.exe
        5⤵
        
        PID:800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2901.exe
      4⤵
      PID:6580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41105.exe
        5⤵
        
        PID:9240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58506.exe
        5⤵
        
        PID:14164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22693.exe
        5⤵
        
        PID:9488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45017.exe
      4⤵
      PID:10232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3382.exe
        5⤵
        
        PID:16288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33335.exe
        5⤵
        
        PID:18400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16546.exe
      4⤵
      PID:12760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11978.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:18484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38106.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38106.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20831.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11038.exe
        5⤵
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38999.exe
        6⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36917.exe
        7⤵
        
        PID:9872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21247.exe
        8⤵
        
        PID:14004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41695.exe
        8⤵
        
        PID:17672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32850.exe
        7⤵
        
        PID:14432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14530.exe
        7⤵
        
        PID:336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31977.exe
        6⤵
        
        PID:8888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3877.exe
        6⤵
        
        PID:14656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63527.exe
        6⤵
        
        PID:9444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36045.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4458.exe
        6⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8994.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3782.exe
        7⤵
        
        PID:8800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4593.exe
        6⤵
        
        PID:11464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54663.exe
        6⤵
        
        PID:1248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33460.exe
        5⤵
        
        PID:9104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63026.exe
        5⤵
        
        PID:13380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47307.exe
        5⤵
        
        PID:19660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28889.exe
      4⤵
      PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54759.exe
        5⤵
        
        PID:5972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16793.exe
        6⤵
        
        PID:7668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48993.exe
        6⤵
        
        PID:13404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4695.exe
        6⤵
        
        PID:18348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19725.exe
        5⤵
        
        PID:9128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48993.exe
        5⤵
        
        PID:13428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64088.exe
        5⤵
        
        PID:19944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17108.exe
      4⤵
      PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60182.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31156.exe
        5⤵
        
        PID:12456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28816.exe
        5⤵
        
        PID:17996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63446.exe
      4⤵
      PID:8220
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8220 -s 488
        5⤵
        Program crash
        
        PID:12536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20380.exe
      4⤵
      PID:12220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60600.exe
      4⤵
      PID:17812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40489.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40489.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48755.exe
      4⤵
      PID:3388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16741.exe
        5⤵
        
        PID:6700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59819.exe
        6⤵
        
        PID:8692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35257.exe
        6⤵
        
        PID:12552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10314.exe
        6⤵
        
        PID:17592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39622.exe
        5⤵
        
        PID:11100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59161.exe
        5⤵
        
        PID:16044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30859.exe
        5⤵
        
        PID:5180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7124.exe
      4⤵
      PID:6588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37479.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40735.exe
        5⤵
        
        PID:4708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60618.exe
      4⤵
      PID:10796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9769.exe
      4⤵
      PID:17320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33509.exe
      4⤵
      PID:18460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2869.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2869.exe
    3⤵
    PID:1048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1666.exe
      4⤵
      PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35787.exe
        5⤵
        
        PID:7992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17495.exe
        6⤵
        
        PID:10608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61114.exe
        6⤵
        
        PID:16092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48942.exe
        5⤵
        
        PID:12248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48949.exe
        5⤵
        
        PID:17132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe
        5⤵
        
        PID:1232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5937.exe
      4⤵
      PID:7248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59783.exe
        5⤵
        
        PID:11452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3595.exe
        5⤵
        
        PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9776.exe
      4⤵
      PID:11904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19687.exe
      4⤵
      PID:5016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18922.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18922.exe
    3⤵
    PID:5272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29155.exe
      4⤵
      PID:7660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4260.exe
      4⤵
      PID:13196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49044.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:17648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50692.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50692.exe
    3⤵
    PID:9164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32109.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32109.exe
    3⤵
    PID:13156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26131.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26131.exe
    3⤵
    PID:5236
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6585.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6585.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12418.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12418.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56871.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38371.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16747.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48298.exe
        7⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8158.exe
        8⤵
        
        PID:8024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6290.exe
        9⤵
        
        PID:10160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13249.exe
        9⤵
        
        PID:14372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29634.exe
        9⤵
        
        PID:19724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41977.exe
        8⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9312.exe
        8⤵
        
        PID:15796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28816.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57581.exe
        7⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41099.exe
        8⤵
        
        PID:16584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36459.exe
        8⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60950.exe
        7⤵
        
        PID:12028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6938.exe
        7⤵
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25276.exe
        6⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41791.exe
        7⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8506.exe
        8⤵
        
        PID:12440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61151.exe
        8⤵
        
        PID:9972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28764.exe
        7⤵
        
        PID:12920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3927.exe
        7⤵
        
        PID:17624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31542.exe
        6⤵
        
        PID:8400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44693.exe
        6⤵
        
        PID:12480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23843.exe
        6⤵
        
        PID:17684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17493.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19975.exe
        6⤵
        
        PID:1032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44583.exe
        7⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65505.exe
        8⤵
        
        PID:9740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32850.exe
        8⤵
        
        PID:14448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61759.exe
        8⤵
        
        PID:19472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7176.exe
        7⤵
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48017.exe
        8⤵
        
        PID:19736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32850.exe
        7⤵
        
        PID:14348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28894.exe
        7⤵
        
        PID:18696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48838.exe
        6⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59819.exe
        7⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22813.exe
        7⤵
        
        PID:13496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20449.exe
        7⤵
        
        PID:9308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39622.exe
        6⤵
        
        PID:11104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6512.exe
        6⤵
        
        PID:15852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47195.exe
        6⤵
        
        PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10720.exe
        5⤵
        
        PID:220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32331.exe
        6⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58667.exe
        7⤵
        
        PID:7612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10566.exe
        8⤵
        
        PID:10524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52118.exe
        8⤵
        
        PID:15708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43371.exe
        8⤵
        
        PID:18112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29725.exe
        7⤵
        
        PID:10936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9312.exe
        7⤵
        
        PID:15748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19879.exe
        7⤵
        
        PID:18064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48506.exe
        6⤵
        
        PID:9032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57161.exe
        6⤵
        
        PID:13024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15411.exe
        6⤵
        
        PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11261.exe
        5⤵
        
        PID:6664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39591.exe
        6⤵
        
        PID:8896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47510.exe
        6⤵
        
        PID:13144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2914.exe
        6⤵
        
        PID:16844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40941.exe
        5⤵
        
        PID:10144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6446.exe
        6⤵
        
        PID:15740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
        6⤵
        
        PID:18472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60934.exe
        5⤵
        
        PID:13132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29425.exe
        5⤵
        
        PID:18580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31717.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25107.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3446.exe
        6⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2242.exe
        7⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32663.exe
        8⤵
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33535.exe
        9⤵
        
        PID:9196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37457.exe
        9⤵
        
        PID:14360
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14360 -s 432
        10⤵
        Program crash
        
        PID:17052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35500.exe
        9⤵
        
        PID:20068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61630.exe
        8⤵
        
        PID:11044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61961.exe
        8⤵
        
        PID:15976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60056.exe
        8⤵
        
        PID:8324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6600.exe
        7⤵
        
        PID:9292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43758.exe
        7⤵
        
        PID:13880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56715.exe
        7⤵
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24717.exe
        6⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59435.exe
        7⤵
        
        PID:7760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21247.exe
        8⤵
        
        PID:13996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6714.exe
        8⤵
        
        PID:9056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24821.exe
        7⤵
        
        PID:11976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18482.exe
        7⤵
        
        PID:18020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63778.exe
        6⤵
        
        PID:10132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41481.exe
        6⤵
        
        PID:13072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60600.exe
        6⤵
        
        PID:17964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        5⤵
        
        PID:4220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44391.exe
        6⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41023.exe
        7⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17775.exe
        8⤵
        
        PID:10028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37457.exe
        8⤵
        
        PID:15224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36512.exe
        8⤵
        
        PID:9528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41209.exe
        7⤵
        
        PID:11008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61961.exe
        7⤵
        
        PID:16004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21846.exe
        7⤵
        
        PID:8316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23425.exe
        6⤵
        
        PID:7780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14052.exe
        6⤵
        
        PID:12196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51976.exe
        6⤵
        
        PID:3640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37877.exe
        5⤵
        
        PID:6468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32937.exe
        6⤵
        
        PID:1112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53077.exe
        6⤵
        
        PID:11912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35500.exe
        6⤵
        
        PID:19888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39326.exe
        5⤵
        
        PID:8880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50277.exe
        5⤵
        
        PID:13220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32779.exe
        5⤵
        
        PID:7060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31228.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-322.exe
        5⤵
        
        PID:3204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27021.exe
        6⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39399.exe
        7⤵
        
        PID:8544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59273.exe
        7⤵
        
        PID:14276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49236.exe
        7⤵
        
        PID:18104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47825.exe
        6⤵
        
        PID:10108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20597.exe
        6⤵
        
        PID:14392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19766.exe
        6⤵
        
        PID:18280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32309.exe
        5⤵
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24127.exe
        6⤵
        
        PID:10864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58157.exe
        7⤵
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48226.exe
        6⤵
        
        PID:16064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29634.exe
        6⤵
        
        PID:19716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17072.exe
        5⤵
        
        PID:9860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63527.exe
        5⤵
        
        PID:9448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32922.exe
      4⤵
      PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35299.exe
        5⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48593.exe
        6⤵
        
        PID:10208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17739.exe
        7⤵
        
        PID:12564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57264.exe
        7⤵
        
        PID:3764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
        6⤵
        
        PID:15204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58682.exe
        6⤵
        
        PID:19968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19393.exe
        5⤵
        
        PID:10400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6512.exe
        5⤵
        
        PID:15884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20527.exe
        5⤵
        
        PID:7528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55497.exe
      4⤵
      PID:6496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-862.exe
        5⤵
        
        PID:8940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48307.exe
        6⤵
        
        PID:15992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21467.exe
        6⤵
        
        PID:17988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13249.exe
        5⤵
        
        PID:14380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62634.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63274.exe
      4⤵
      PID:10352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23181.exe
        5⤵
        
        PID:8312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37351.exe
      4⤵
      PID:14272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21770.exe
      4⤵
      PID:17144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49258.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49258.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12641.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43903.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13726.exe
        6⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51334.exe
        7⤵
        
        PID:7384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25943.exe
        8⤵
        
        PID:8928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63336.exe
        9⤵
        
        PID:9312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5081.exe
        8⤵
        
        PID:14488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3106.exe
        8⤵
        
        PID:19572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13912.exe
        7⤵
        
        PID:11028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2289.exe
        7⤵
        
        PID:15924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2138.exe
        7⤵
        
        PID:19540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16933.exe
        6⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39399.exe
        7⤵
        
        PID:8552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30981.exe
        7⤵
        
        PID:12652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47071.exe
        7⤵
        
        PID:3956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47825.exe
        6⤵
        
        PID:10056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20597.exe
        6⤵
        
        PID:14408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2138.exe
        6⤵
        
        PID:19764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19133.exe
        5⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28579.exe
        6⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33447.exe
        7⤵
        
        PID:10304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61114.exe
        7⤵
        
        PID:15836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29634.exe
        7⤵
        
        PID:19904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48942.exe
        6⤵
        
        PID:12272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48949.exe
        6⤵
        
        PID:17148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12464.exe
        5⤵
        
        PID:7488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8994.exe
        6⤵
        
        PID:14508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15899.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:19816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60950.exe
        5⤵
        
        PID:12128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14530.exe
        5⤵
        
        PID:4492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25520.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37655.exe
        5⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57603.exe
        6⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41105.exe
        7⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25331.exe
        8⤵
        
        PID:13676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16039.exe
        8⤵
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48993.exe
        7⤵
        
        PID:13452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36704.exe
        7⤵
        
        PID:9352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7176.exe
        6⤵
        
        PID:6172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61630.exe
        6⤵
        
        PID:14524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7514.exe
        6⤵
        
        PID:17568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2325.exe
        5⤵
        
        PID:7172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26239.exe
        6⤵
        
        PID:11456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54098.exe
        6⤵
        
        PID:16704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2146.exe
        6⤵
        
        PID:17700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31018.exe
        5⤵
        
        PID:11936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46149.exe
        5⤵
        
        PID:17124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30771.exe
        5⤵
        
        PID:19772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38734.exe
      4⤵
      PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49575.exe
        5⤵
        
        PID:6188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7930.exe
        6⤵
        
        PID:12148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9983.exe
        6⤵
        
        PID:19596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28764.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20263.exe
        5⤵
        
        PID:17884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30660.exe
      4⤵
      PID:8844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exe
      4⤵
      PID:13048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49269.exe
      4⤵
      PID:18416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32240.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32240.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46451.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11614.exe
        5⤵
        
        PID:4568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23431.exe
        6⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35869.exe
        7⤵
        
        PID:8700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65329.exe
        7⤵
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45152.exe
        7⤵
        
        PID:17172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47790.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41564.exe
        6⤵
        
        PID:17284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24717.exe
        5⤵
        
        PID:6248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38439.exe
        6⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8506.exe
        7⤵
        
        PID:12420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15899.exe
        7⤵
        
        PID:19788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17037.exe
        6⤵
        
        PID:11564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-994.exe
        6⤵
        
        PID:448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33460.exe
        5⤵
        
        PID:9112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1307.exe
        6⤵
        
        PID:19568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7464.exe
        5⤵
        
        PID:14672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7123.exe
        5⤵
        
        PID:18192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20337.exe
      4⤵
      PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20079.exe
        5⤵
        
        PID:6344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28579.exe
        6⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63467.exe
        7⤵
        
        PID:10204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46114.exe
        7⤵
        
        PID:14512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46687.exe
        7⤵
        
        PID:1132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50146.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9312.exe
        6⤵
        
        PID:15784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52360.exe
        6⤵
        
        PID:2040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60182.exe
        5⤵
        
        PID:7636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31156.exe
        5⤵
        
        PID:12464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe
        5⤵
        
        PID:4388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5396.exe
      4⤵
      PID:6648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53867.exe
        5⤵
        
        PID:11380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37761.exe
        5⤵
        
        PID:16608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28425.exe
        5⤵
        
        PID:5896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59310.exe
      4⤵
      PID:10508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14044.exe
      4⤵
      PID:15828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22878.exe
      4⤵
      PID:9824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42102.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42102.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3446.exe
      4⤵
      PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10410.exe
        5⤵
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36917.exe
        6⤵
        
        PID:9880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61630.exe
        6⤵
        
        PID:14544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20150.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7176.exe
        5⤵
        
        PID:7764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32850.exe
        5⤵
        
        PID:14832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15682.exe
        5⤵
        
        PID:17956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32693.exe
      4⤵
      PID:6164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42279.exe
        5⤵
        
        PID:9932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37457.exe
        5⤵
        
        PID:13476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24348.exe
        5⤵
        
        PID:17900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39849.exe
      4⤵
      PID:4528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34656.exe
      4⤵
      PID:14912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24611.exe
      4⤵
      PID:18604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7920.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7920.exe
    3⤵
    PID:1180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7826.exe
      4⤵
      PID:6288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61635.exe
        5⤵
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43063.exe
        6⤵
        
        PID:13064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10606.exe
        6⤵
        
        PID:20052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28764.exe
        5⤵
        
        PID:12976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60440.exe
        5⤵
        
        PID:19528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39953.exe
      4⤵
      PID:8584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24680.exe
      4⤵
      PID:12872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57980.exe
      4⤵
      PID:1504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34877.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34877.exe
    3⤵
    PID:6532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58667.exe
      4⤵
      PID:7512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26985.exe
        5⤵
        
        PID:11652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32132.exe
        5⤵
        
        PID:2948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59466.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48949.exe
      4⤵
      PID:17156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60440.exe
      4⤵
      PID:20056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59971.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59971.exe
    3⤵
    PID:8992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29276.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29276.exe
    3⤵
    PID:13032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22979.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22979.exe
    3⤵
    PID:7536
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14456.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14456.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56871.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56871.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46539.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49419.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48755.exe
        6⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40949.exe
        7⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42279.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53985.exe
        8⤵
        
        PID:11988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59096.exe
        8⤵
        
        PID:8448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32030.exe
        7⤵
        
        PID:10952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59161.exe
        7⤵
        
        PID:16096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49307.exe
        7⤵
        
        PID:19916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3373.exe
        6⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47183.exe
        7⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62952.exe
        8⤵
        
        PID:8304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61437.exe
        7⤵
        
        PID:13608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41068.exe
        7⤵
        
        PID:18380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43357.exe
        6⤵
        
        PID:3236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43758.exe
        6⤵
        
        PID:13896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4385.exe
        5⤵
        
        PID:5044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34339.exe
        6⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8158.exe
        7⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14474.exe
        8⤵
        
        PID:13224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38379.exe
        8⤵
        
        PID:7372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48942.exe
        7⤵
        
        PID:12264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48949.exe
        7⤵
        
        PID:17108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65380.exe
        7⤵
        
        PID:5196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6600.exe
        6⤵
        
        PID:9284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6809.exe
        6⤵
        
        PID:13740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28038.exe
        6⤵
        
        PID:6424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41578.exe
        5⤵
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54915.exe
        6⤵
        
        PID:8480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe
        6⤵
        
        PID:15356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1378.exe
        6⤵
        
        PID:17084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51953.exe
        5⤵
        
        PID:10832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53010.exe
        5⤵
        
        PID:19928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54250.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48298.exe
        5⤵
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8734.exe
        6⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14650.exe
        7⤵
        
        PID:10684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19445.exe
        7⤵
        
        PID:15772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31694.exe
        7⤵
        
        PID:18704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50338.exe
        6⤵
        
        PID:11096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9312.exe
        6⤵
        
        PID:15320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64228.exe
        6⤵
        
        PID:1128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62241.exe
        5⤵
        
        PID:8964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63026.exe
        5⤵
        
        PID:13388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65075.exe
        5⤵
        
        PID:18032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35226.exe
      4⤵
      PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53550.exe
        5⤵
        
        PID:8288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56709.exe
        6⤵
        
        PID:2476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48993.exe
        5⤵
        
        PID:13436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57980.exe
        5⤵
        
        PID:3624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59441.exe
      4⤵
      PID:8948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41909.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41909.exe
      4⤵
      PID:13348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20099.exe
      4⤵
      PID:6488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47757.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47757.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48179.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54074.exe
        5⤵
        
        PID:6888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25071.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5294.exe
        7⤵
        
        PID:15180
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15180 -s 464
        8⤵
        Program crash
        
        PID:16908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15899.exe
        7⤵
        
        PID:20088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28764.exe
        6⤵
        
        PID:12928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64415.exe
        6⤵
        
        PID:8908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33460.exe
        5⤵
        
        PID:9116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7464.exe
        5⤵
        
        PID:14680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24035.exe
        5⤵
        
        PID:18404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18749.exe
      4⤵
      PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53659.exe
        5⤵
        
        PID:7404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8994.exe
        6⤵
        
        PID:12988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3014.exe
        6⤵
        
        PID:19676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28764.exe
        5⤵
        
        PID:12948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56060.exe
        5⤵
        
        PID:3684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33460.exe
      4⤵
      PID:8804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58942.exe
      4⤵
      PID:13004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48739.exe
      4⤵
      PID:4320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60166.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60166.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33763.exe
      4⤵
      PID:5680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24931.exe
        5⤵
        
        PID:7052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41105.exe
        6⤵
        
        PID:8236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48993.exe
        6⤵
        
        PID:13420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24348.exe
        6⤵
        
        PID:17908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60758.exe
        5⤵
        
        PID:9180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53077.exe
        5⤵
        
        PID:13356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51282.exe
        5⤵
        
        PID:8532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2325.exe
      4⤵
      PID:6140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31475.exe
        5⤵
        
        PID:11148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38379.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51437.exe
      4⤵
      PID:11228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60678.exe
      4⤵
      PID:1432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44655.exe
      4⤵
      PID:6876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45829.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45829.exe
    3⤵
    PID:5960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57743.exe
      4⤵
      PID:7916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8890.exe
        5⤵
        
        PID:10624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17037.exe
      4⤵
      PID:11576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
      4⤵
      PID:3284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14125.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14125.exe
    3⤵
    PID:8868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58975.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58975.exe
    3⤵
    PID:13116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7894.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7894.exe
    3⤵
    PID:18656
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56606.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56606.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46539.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46539.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33275.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27877.exe
        5⤵
        
        PID:3156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57743.exe
        6⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13166.exe
        7⤵
        
        PID:12344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4939.exe
        7⤵
        
        PID:18044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-509.exe
        6⤵
        
        PID:8144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
        6⤵
        
        PID:688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45713.exe
        5⤵
        
        PID:8852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5657.exe
        5⤵
        
        PID:13192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56715.exe
        5⤵
        
        PID:3160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13321.exe
      4⤵
      PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23047.exe
        5⤵
        
        PID:5288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16793.exe
        6⤵
        
        PID:8204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37893.exe
        6⤵
        
        PID:13856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59096.exe
        6⤵
        
        PID:8452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36061.exe
        5⤵
        
        PID:8984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61245.exe
        5⤵
        
        PID:10996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23196.exe
        5⤵
        
        PID:4932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37877.exe
      4⤵
      PID:6460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38365.exe
        5⤵
        
        PID:9156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55765.exe
        5⤵
        
        PID:14552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23191.exe
        5⤵
        
        PID:6660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49606.exe
      4⤵
      PID:10136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11932.exe
      4⤵
      PID:13096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44943.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17493.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17493.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45439.exe
      4⤵
      PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52559.exe
        5⤵
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57551.exe
        6⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10758.exe
        7⤵
        
        PID:10732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48226.exe
        7⤵
        
        PID:16072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22950.exe
        7⤵
        
        PID:17976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38277.exe
        6⤵
        
        PID:11368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51497.exe
        6⤵
        
        PID:16616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64612.exe
        6⤵
        
        PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51909.exe
        5⤵
        
        PID:10212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24682.exe
        5⤵
        
        PID:12984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41147.exe
        5⤵
        
        PID:18616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24141.exe
      4⤵
      PID:6436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32937.exe
        5⤵
        
        PID:8200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65329.exe
        5⤵
        
        PID:13328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        5⤵
        
        PID:7104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33460.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63026.exe
      4⤵
      PID:13396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60223.exe
      4⤵
      PID:2060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27056.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27056.exe
    3⤵
    PID:1064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27021.exe
      4⤵
      PID:7200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59575.exe
        5⤵
        
        PID:10576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3109.exe
        5⤵
        
        PID:16152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11082.exe
        5⤵
        
        PID:18720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63689.exe
      4⤵
      PID:8764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60678.exe
      4⤵
      PID:15256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26834.exe
      4⤵
      PID:19800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60078.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60078.exe
    3⤵
    PID:6520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48593.exe
      4⤵
      PID:8956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61791.exe
        5⤵
        
        PID:12404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48048.exe
        5⤵
        
        PID:7304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59710.exe
      4⤵
      PID:14048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32978.exe
      4⤵
      PID:18556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50889.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50889.exe
    3⤵
    PID:8636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9429.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9429.exe
    3⤵
    PID:12960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35673.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35673.exe
    3⤵
    PID:380
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42653.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42653.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8578.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8578.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24251.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24909.exe
        5⤵
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59819.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39341.exe
        6⤵
        
        PID:13372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18482.exe
        6⤵
        
        PID:17944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4672.exe
        5⤵
        
        PID:11784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62286.exe
        5⤵
        
        PID:17092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8812.exe
        5⤵
        
        PID:18676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18749.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6342.exe
        5⤵
        
        PID:7316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8994.exe
        6⤵
        
        PID:13108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6138.exe
        6⤵
        
        PID:6492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-317.exe
        5⤵
        
        PID:12176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10314.exe
        5⤵
        
        PID:17580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59885.exe
      4⤵
      PID:9260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43758.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18609.exe
      4⤵
      PID:3512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-493.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-493.exe
    3⤵
    PID:3420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18195.exe
      4⤵
      PID:6112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8158.exe
        5⤵
        
        PID:8064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55507.exe
        6⤵
        
        PID:13076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44820.exe
        6⤵
        
        PID:1040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48942.exe
        5⤵
        
        PID:12280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15027.exe
        5⤵
        
        PID:1160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60182.exe
      4⤵
      PID:7848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45263.exe
        5⤵
        
        PID:12380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50824.exe
        5⤵
        
        PID:7268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
      4⤵
      PID:12100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36216.exe
      4⤵
      PID:4476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe
    3⤵
    PID:5304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12818.exe
      4⤵
      PID:7788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13078.exe
        5⤵
        
        PID:14664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61962.exe
      4⤵
      PID:11292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26266.exe
      4⤵
      PID:4184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2569.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2569.exe
    3⤵
    PID:9040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50277.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50277.exe
    3⤵
    PID:13340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56236.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56236.exe
    3⤵
    PID:6364
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56818.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56818.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52647.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52647.exe
    3⤵
    PID:5084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58734.exe
      4⤵
      PID:7092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59575.exe
        5⤵
        
        PID:10692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19445.exe
        5⤵
        
        PID:15756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64559.exe
        5⤵
        
        PID:19512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29864.exe
      4⤵
      PID:11168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2289.exe
      4⤵
      PID:15960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56715.exe
      4⤵
      PID:5184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-213.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-213.exe
    3⤵
    PID:6336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59435.exe
      4⤵
      PID:1540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41349.exe
      4⤵
      PID:12080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47455.exe
      4⤵
      PID:18392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55609.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55609.exe
    3⤵
    PID:9220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13825.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13825.exe
    3⤵
    PID:9356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55755.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55755.exe
    3⤵
    PID:4660
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37039.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37039.exe
  2⤵
  PID:2624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23431.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23431.exe
    3⤵
    PID:5756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12242.exe
      4⤵
      PID:8048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-914.exe
        5⤵
        
        PID:12328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17959.exe
        5⤵
        
        PID:18628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57110.exe
      4⤵
      PID:10888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48949.exe
      4⤵
      PID:17184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30207.exe
      4⤵
      PID:19796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43846.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43846.exe
    3⤵
    PID:7332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
    3⤵
    PID:12036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56060.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56060.exe
    3⤵
    PID:2448
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58652.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58652.exe
  2⤵
  PID:6104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8158.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8158.exe
    3⤵
    PID:8056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30987.exe
      4⤵
      PID:10664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19445.exe
      4⤵
      PID:15764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2914.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2914.exe
      4⤵
      PID:5520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46254.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46254.exe
    3⤵
    PID:11068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9312.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9312.exe
    3⤵
    PID:13840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41644.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41644.exe
    3⤵
    PID:18500
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48865.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48865.exe
  2⤵
  PID:7424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19761.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19761.exe
    3⤵
    PID:1928
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30149.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30149.exe
  2⤵
  PID:12044
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38556.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38556.exe
  2⤵
  PID:5188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5624 -ip 5624
1⤵
PID:5792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 8220 -ip 8220
1⤵
PID:12492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 14476 -ip 14476
1⤵
PID:16808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 13996 -ip 13996
1⤵
PID:16852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 12684 -ip 12684
1⤵
PID:16900

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12418.exe

Filesize
468KB

MD5
3bdbc5ff01ca15035a39e18d0f47b8aa

SHA1
0da064aaba90de74d5dd80a59e72f3eb695b8b35

SHA256
75cac83fffe66332c433c6ea670d3259027e872d3bf198612da27d133905a30f

SHA512
9f92b817f108e45ccdf73abfed3b53814c5584dda3ad91addf2f31dfbe2daac756e7a35a6771e78570b3657f01c7d6f0a7d7222eec962dc127865eb83bc7f904

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12641.exe

Filesize
468KB

MD5
b53a4a69595325ed21291a1c11ed002e

SHA1
e1cb91359122f0fa95c630d3ca929b1fd7d29d7d

SHA256
4022ff6659725f99efac6564579b24b286fe694e58ae4471f32291886bca9c48

SHA512
43a2b8b4f65def24a966cebce0f2b937b25dbf864b1330b5d2a2495484b158056f694cb6cbe93cbf7052f5a98e7b5a37a976c1ca3d9d7aec6825971a8c7d22e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14456.exe

Filesize
468KB

MD5
8e775eb7e211132ba19099121380585b

SHA1
9bd9e0f038f35d74f56f59996852c6ade64036eb

SHA256
9d05c912707a90219848c2d3524017252e9d8df953bd097edf21abce1254f843

SHA512
c63c45fce119afa48b09bfa55ddd8b33b33398316e5f785206834724b37bc5c139b33b9843fa912d42f23ea800875499d1ef623bad4a425dd05096708126b92b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17951.exe

Filesize
468KB

MD5
412f5de43243b127142442c6cbb6218b

SHA1
f3c961280bad7b35f64eb8899ea0a14872ba4835

SHA256
35e2352f9b9566bb556c4751096bff38ca810587ba6b88bb812ac59fb54dad85

SHA512
ef54bdd43e92d88257b00719c4ba352a70cdac4b654a6027730b0754d16e33a6fca1e0a25f2b5855f95caf077d2193efed005cab268557026d90d098f16fa95e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18091.exe

Filesize
468KB

MD5
8759d1e0f33370e77125c22b6f34f444

SHA1
ce7afe8ed81148fda6e873ab50fd79ca83d07084

SHA256
f55490d807310097cadeddc2baa781f181a552c3d4095328a706207e596cb0be

SHA512
00d69a65119eef1a1b1f51fae41944d12bae503bebf8c177ae10b997acb7b892f868a5d8d2de902660f09d414a550746e0bc81f7d07d86536adb92fd09691390

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20447.exe

Filesize
468KB

MD5
bd233144e64bbcb69a11a47ac6c141cd

SHA1
1f24c9cc309245d95b5e53c1c8a4424a511aa43f

SHA256
341a3428e89828b2c836a7caf3584198b1d5fde47f47433a11b2b92d55015aa8

SHA512
aa1228e83a373045baf63d9b532d7682762732cdcb830c8f6afb1184951a9f35fb0240b1b864625bd0e973e27f882dda086fb0b471414b011e33902d93845127

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21001.exe

Filesize
468KB

MD5
504bb933e930af4ac7c1866981977378

SHA1
86853ea5e1b54185f0f0632011d03cf675c745bd

SHA256
4567df596f39d9e91d222545999a4eb91905d6eaeeb0755e39df8fbbe459a58d

SHA512
b5358284922b034ef2082386980bedd85c39eb3ada798023dd4bd3926a1623d0daa14060d189d1c49d08799949c2589f2bd50dfa253da902131e64cdec2e2d5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28350.exe

Filesize
468KB

MD5
b9ab9ee3691294ea6f657d2667313a5f

SHA1
eb0feda9059991d6da33f59839d6fc0bc372612d

SHA256
73da8153afdb4db1a300a5021931d496ba1b3ed7cca70b606c9a2f2d2da28c12

SHA512
66e239289f92474bbd4b230f8fcf362ed44b696aa00d9e11c1b8c061d28fb3ed489d37be946e74afe43ce1d8d82f061c7b364b5b987d62eb15679585a8f6ee9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28615.exe

Filesize
468KB

MD5
a176d7de430141cb7eb691d6485ed4ab

SHA1
b5c94bb973b70d9f60506b366bc669ad8c269021

SHA256
173abcc0921feec4cd91201025d35f47d90cc2a7fd267ccd9f221df1890bcf4a

SHA512
1fc3305320a0d4b3819787924b853037b254d361e847b5b837a671ab533c754c592e13a08ceaadf89054373ea548f62684efe2f4f15c355d3be2b81af3c049b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30757.exe

Filesize
468KB

MD5
08d93cf8cc233fffc4701b6b51d5a763

SHA1
5a1b3713261ccdf6980db381f0e9f5054eee62cc

SHA256
1f86528f2f149b127d5ce51c4e54281d64f353aa0df7dc31530be0d5df3e268f

SHA512
1166d2f9c34afb8fc786037397fabd179a5a8a79f72e1353b24cad288d89b366799ac4bc11cf73838b1e5ccd55407aec8fd9760406f67d0a9895f7c1f04b0c74

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31472.exe

Filesize
468KB

MD5
145c25d009ccb601ccab18284c581808

SHA1
e820a208a7ef44e8b84bc390a53f671cc7c3bbe8

SHA256
95c2d593e1e20052e00accd0e9e5985d0bfef328109ae7ef417c01ca3e53c792

SHA512
2811d4f9a40f81a40c82f620aa2da99bc25ad3f27049571bff6bc5f4d2189ff8b3e121f41cad499b53998fef0519feafe6cb0c31653848015132dd7a972ffe33

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31717.exe

Filesize
468KB

MD5
534663bfe24090be6daa118c5d18828a

SHA1
05425800e7907ce773b9dbd7ba7eb43e2ade29c9

SHA256
4a7f7b6974c002c198a6116afb20bc5f00b5093650ab780b02becd5a22c1e3bd

SHA512
3bd5052089cf9e3f6a15c48174187c1ef7b8ee8da7e710a0ecb946b867133dff39858b0cb0ec061b22e3d3f3951c6c10279a4c547355781abe1bb73471a270fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32240.exe

Filesize
468KB

MD5
5fae5527a7f6f3a12d0f9015eca102dc

SHA1
19f654020f3cdfa5c697e7e7a82a1510da17e9eb

SHA256
af942722135ba71058f60a850251ea58a0e0b4ce4bdf2c4720d5e1595dd1e8ed

SHA512
cfa007b51fb474ab42a8fdf26baa65c57b5ec58ac5595cb3803bc2298a0a91eaaa794da0e5faf6d8f5afb8d66c1b6df86f22df72e19ebe9bb3c2644e3b04f916

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37603.exe

Filesize
468KB

MD5
b49e755019b94153b0fe37826a72b622

SHA1
b29531155981827c9876c0d7dfadd8684ca821e1

SHA256
6f53daa8b3a7acfc0f8b43a921605dd87eeb7a3a1ac581c4bb329c853bdc350a

SHA512
d9b42a1345a05c7ce7fc8291166aa2abffba4daa506c99cbf99b2a3c67c8bc56974bd5b6e3a2a5f038bb756dc7f176c47ddd64da46f23e6ecaa62ce2aae6c529

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38106.exe

Filesize
468KB

MD5
13b59358caec9c80ca8c622b63cc82e7

SHA1
b8ff3219900d1d8cacaff7651fd171e78d92b3d2

SHA256
e3804587c1e125241f02827d509e08ae91ce811dc8fd497f6df05bbe04ef9fe5

SHA512
e92f88ee1476dbd088d891a6fd9a6b5d263774d88e6850710224df7f6deddbe09cda80a5fa91c3eb1d8f895660f522924a4668973afe643f06e9197cb36b0fa1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38371.exe

Filesize
468KB

MD5
f1fb4a4f2ba16af10d3b6ca2c6a94799

SHA1
b9830af8e637e29a3cf942e57507cc62ccf3e755

SHA256
f8d15af52d208444bd302ac3b8c296c04c2cf9e8837cf5b6454e8b38661a4364

SHA512
48ca5e240502205f5419894b796c963354ee4f1f1f667d2f580d8a8063895d38736081da0d1a9a12cb08400665547da5f285e029008017041f697f16016fba8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39923.exe

Filesize
468KB

MD5
2a1b0e827c4a71cb7594a6f0b3017ef0

SHA1
24abf8c06adc4336a194409f0812a0e5075b4849

SHA256
09d333c4d99f9e03f04204bf7374b5991a62d6b8a754f9a388f38a75e0194000

SHA512
6e338faa37e6360bec0780cb9189118148c8588c8f2a8e2e269e0e557defa54718116e1c33e547defbefc1e626ddfbeed43fd4f16fe74983bb70b8b62cf38556

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42653.exe

Filesize
468KB

MD5
9db0e41df00888d45a7b9ac0f9fd32c5

SHA1
9ee987531fb7c1c2e6467c5a03ab031f9d0e49c5

SHA256
ab30dad6a50641aa3d6ce5130b0270885c22f9c3058f5e440a8fe540b3407f4a

SHA512
af5a6cc09352702a47122e796e33012cac4981c6cb7bf536ee63c0d064ce5791ca41688f0a316b5280ee3ae401a5aadd1d09588f36f2562eeae78a861f1b2b35

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46347.exe

Filesize
468KB

MD5
4edfdfa462d0ada3ffe9e7b15a21f2bd

SHA1
0f64e44931b0774ed34ca5e1a3c6866450a9e55f

SHA256
25de711a0b66d00f743a0bb4557300627c9c10d0ac4aa39792e5e535cfb49d0c

SHA512
617840d316634c21ba585ef062b32e41752b8c90cb62d9d25e89f73ab1714a3479e6da8deba6aab7448d53bff146c2711f9f2fe23b9e164e59b6052084452702

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46539.exe

Filesize
468KB

MD5
24a6fadcda0043175e98ad46e800bb76

SHA1
262d5a69f0a8c7f6767fa4d4bc9061993eb2f661

SHA256
8186d30d661824500643287196be117fb01122d70bb1d63a348794a4ab374740

SHA512
fce7d4815f7333d64dacfff2f66223e9b520093e0abc21b2382f3e7000ab6808f52589eb95a811ae94ddd718d12c2c0e5e52250080f97210959ece0e9250ca11

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48703.exe

Filesize
468KB

MD5
c57e6d2fcdf86e841e7fddc9c7dc9429

SHA1
66d37b1d90d4fa13c1389b1a48261962a80bd257

SHA256
2a57dbd7fbf77396dca83eb2cd64b7557fc8b632a135889bc47d39cd955cefa2

SHA512
47f1111e9a5d675f2c10f0dc626c38769473f3612e34771ff01ec3d76294317d5075b43ef04120a79cdf3c1af2ce78e259994632aefaeed03ed36704420d85fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49258.exe

Filesize
468KB

MD5
185b704378744f09555e4baae01eac15

SHA1
df23c72d2702a50782599c4eeb7fe7696920e100

SHA256
06a5aff442f44dae1935956998d2dc0fb3e54ccfd72843a3710ea0bebac0e8bb

SHA512
6260641717daa766bcfe88fb7d4b00229c399458c4e98f50cbc2c36a14d362d6d104b6776c98fff46e04682add5e2cdd0ac5a36a1f386d90688c2adfb39181c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56310.exe

Filesize
468KB

MD5
f9dbbbfc72415169f66a3cbe83cf5bb5

SHA1
3c3c13894115fc08e68223bfb8845aa666299358

SHA256
f727e713f724a1b402897bc725408c2dcb362e76a4ed5aebaae2245e16a18aec

SHA512
b21cdb7fdaee1b7e6490e86eac9708b2d16e164f4f2c1151aec1c752f253eeeb4c5a6d436871c8cbc376db18bd6ff74726b346080bf939285eca606c56a8241f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56606.exe

Filesize
468KB

MD5
e399f21c07cfedfc87122af8496b7351

SHA1
d1e8fe6ec9e7367ab60014f57885e456e220f9f1

SHA256
420803ae07e998197fbe44b513008deaf17d7f3e8fe652c6aa73c9326bf45d28

SHA512
a37ab4ed82ba7a29d7ee0c3fb6f28c04b80dfebf64871b8b500e88db2f7b415dbb06281a8027ba4fc5d6bd54a320b59729d1363c8d8423602c3630388bfcc2d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56871.exe

Filesize
468KB

MD5
9cf15b4a4e4b6b9b2757f09ee3201820

SHA1
cce06308810502c052a1abfb759a1b29f8bb4df9

SHA256
a7da405d15ed619cda0c8a328a3c2965c6d85306ee92b30845fba4ac22120207

SHA512
c4431444a5af3cf3f24476e0f1196dc80350c0e3e7f00f94f1d5781cfb1ad29982011eddd88ffb33ef317c09b69f4d326c0fc3f7101d065ca7c60f3b59dde767

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe

Filesize
468KB

MD5
3d593c27886f17467e026f87c55515d5

SHA1
c257ae15f6908285bd528a5b8a6549cedfe77227

SHA256
63a6d546b520ed5e7faf961dd3ad23ebdd0088fc51d2dc0149ded80c74e0b734

SHA512
b73645657c8358b32589ae9da9e9912030b24541d21814948dcf19a27a7edf14cc50b213cd383d03376a7e43474e3eb876eefc9b6647029a4e9f777bc2ead9e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61515.exe

Filesize
468KB

MD5
a27f528d83b3d538331dd0112f099afe

SHA1
408b806cace991dbf65b94c59780d2f21f5e200b

SHA256
33f8c68eb2f248c5cac6734a63c1a738048c6bd553e17fff67bf08fcbea15d36

SHA512
f78b4a3de945157347f2ad6e016bc96c6727aee8a050692390ff85f9f4caf07a33679f9a2689d1a2dec9fe2b15d8078b3ec2abd5e6746077193327b8069954fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62993.exe

Filesize
468KB

MD5
5f00345be7dd4f7a43fdfa9173a7e7cb

SHA1
1924cd5e1d8e823b1484c706473eb3f233f59cb6

SHA256
38d74d74eec0b3d2c0f0c6c35bc3be7d9e957e39f61fef71450867a597db8daa

SHA512
793f71acce162ed50aa39babec8d87cce3e096d3c1d771b89774c271767123d0e5699be0a834837dbb05f296ae7ebb47472023b4ee63dd19fdf645644747d743

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6585.exe

Filesize
468KB

MD5
c299e70b0397e2c54395e7aa578d2edd

SHA1
f5b69a08833939d5ff57a845931f0f97cdc56d59

SHA256
6248efbef68fbf97d161a11f9fddef7cccdfea22ed8566ee5c364b5e1cea76f2

SHA512
6dd77363703798a346a92b38b96e20b8474bd119421c2850a33359c38acb1036780852d2227b238cd0fc87f3b538579a1ec6392f2dfae5435a11d067271e52e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-721.exe

Filesize
468KB

MD5
380392233062efcb8059fe406c60d40d

SHA1
23b6587b5c2e915eb0ae4d2332c418c405737b37

SHA256
42292100faac565de3fb5c95fe26e53b44b7f03788a51ffcba29f0728e4b681e

SHA512
736d7e3f13ddc7544f810c8be4f1df65ff75cdb99e1c1bbfdd1e4c739cf001b2ddd6e3b33426e4c5140d0c2e04d00b9a887d41fc907731440147e6552a6cd8e1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads