4539c8140558eceb70e4ad6249b3109127586959a89fad30b1251ece2b2ea2f2

Analysis

max time kernel
114s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2024, 01:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4539c8140558eceb70e4ad6249b3109127586959a89fad30b1251ece2b2ea2f2N.exe
Size

468KB
MD5

422a6d9b5d4aa8abd24dd7c158baccb0
SHA1

0995a88ee5a2e9714fcd715586f46347e60a1a53
SHA256

4539c8140558eceb70e4ad6249b3109127586959a89fad30b1251ece2b2ea2f2
SHA512

fe138e78d145c30e2450f7c9e0946e8d98a5a9d0c9831b5832e294063a74f62f547aba64c81f0905efc5b8bc2d321a8399b52f18d3e5c198823baf6b9f54f81e
SSDEEP

3072:lGoHogIKI05TkbYJHzcJcfr/SChzn0p0nLHeaVPkXW5O3Cpj/rlB:lGIoD8TkOH4Jcf9YVNXWMSpj/

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
8	Unicorn-41111.exe
1560	Unicorn-26519.exe
4576	Unicorn-56731.exe
3920	Unicorn-6070.exe
1576	Unicorn-2654.exe
1652	Unicorn-3994.exe
4840	Unicorn-1213.exe
4772	Unicorn-30996.exe
4104	Unicorn-48977.exe
1036	Unicorn-48977.exe
1948	Unicorn-13709.exe
1372	Unicorn-59646.exe
4060	Unicorn-7844.exe
5056	Unicorn-35511.exe
5076	Unicorn-32094.exe
4636	Unicorn-48692.exe
1012	Unicorn-13331.exe
3972	Unicorn-59003.exe
4064	Unicorn-62039.exe
2284	Unicorn-61847.exe
2336	Unicorn-53685.exe
5020	Unicorn-62615.exe
2480	Unicorn-56485.exe
4648	Unicorn-62350.exe
4276	Unicorn-59963.exe
3984	Unicorn-59963.exe
900	Unicorn-40221.exe
684	Unicorn-3526.exe
2072	Unicorn-23392.exe
3460	Unicorn-57745.exe
2792	Unicorn-39680.exe
2596	Unicorn-50330.exe
748	Unicorn-21114.exe
2592	Unicorn-4092.exe
212	Unicorn-1824.exe
4280	Unicorn-15171.exe
1620	Unicorn-35805.exe
3676	Unicorn-18784.exe
3432	Unicorn-53402.exe
4344	Unicorn-27357.exe
2632	Unicorn-11897.exe
4976	Unicorn-11705.exe
1824	Unicorn-57377.exe
4892	Unicorn-11705.exe
3264	Unicorn-25088.exe
4580	Unicorn-2659.exe
4512	Unicorn-21994.exe
2904	Unicorn-8259.exe
4028	Unicorn-19002.exe
2568	Unicorn-21802.exe
3384	Unicorn-27668.exe
2356	Unicorn-4985.exe
4480	Unicorn-4227.exe
3500	Unicorn-9593.exe
2256	Unicorn-64638.exe
4452	Unicorn-8031.exe
3980	Unicorn-52961.exe
2644	Unicorn-7289.exe
864	Unicorn-16426.exe
4360	Unicorn-47933.exe
4056	Unicorn-59592.exe
1956	Unicorn-1119.exe
4008	Unicorn-48929.exe
1504	Unicorn-51773.exe

Program crash 12 IoCs

pid	pid_target	Process	procid_target
4600	3920	WerFault.exe	92
6360	3984	WerFault.exe	117
6740	4276	WerFault.exe	116
6780	3376	WerFault.exe	175
6832	1620	WerFault.exe	131
8712	6036	WerFault.exe	231
9296	656	WerFault.exe	167
8880	5732	WerFault.exe	229
9156	5612	WerFault.exe	227
14596	6952	WerFault.exe	300
13284	6832	WerFault.exe	494
15868	13284	WerFault.exe	827

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58618.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15028.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42014.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42590.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15481.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52657.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21705.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23979.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34884.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40500.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40803.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31488.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24212.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48168.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52517.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11705.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16538.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31341.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13497.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29845.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39680.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26650.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36725.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54881.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49213.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14454.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47052.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19002.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49700.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49518.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8031.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13709.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56675.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42202.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55157.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41421.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30996.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48637.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23005.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3508.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25421.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44683.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-394.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23089.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28788.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61214.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16724.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36857.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-650.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61022.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57381.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55860.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29588.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45368.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52093.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53181.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22595.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32122.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32973.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35821.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60791.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	2860	dwm.exe
Token: SeChangeNotifyPrivilege	2860	dwm.exe
Token: 33	2860	dwm.exe
Token: SeIncBasePriorityPrivilege	2860	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1636	4539c8140558eceb70e4ad6249b3109127586959a89fad30b1251ece2b2ea2f2N.exe
8	Unicorn-41111.exe
4576	Unicorn-56731.exe
1560	Unicorn-26519.exe
1576	Unicorn-2654.exe
3920	Unicorn-6070.exe
1652	Unicorn-3994.exe
4840	Unicorn-1213.exe
4104	Unicorn-48977.exe
4772	Unicorn-30996.exe
1036	Unicorn-48977.exe
1948	Unicorn-13709.exe
1372	Unicorn-59646.exe
4060	Unicorn-7844.exe
5056	Unicorn-35511.exe
5076	Unicorn-32094.exe
4636	Unicorn-48692.exe
4064	Unicorn-62039.exe
3972	Unicorn-59003.exe
1012	Unicorn-13331.exe
4276	Unicorn-59963.exe
4648	Unicorn-62350.exe
3984	Unicorn-59963.exe
2480	Unicorn-56485.exe
2284	Unicorn-61847.exe
2336	Unicorn-53685.exe
5020	Unicorn-62615.exe
900	Unicorn-40221.exe
2072	Unicorn-23392.exe
684	Unicorn-3526.exe
3460	Unicorn-57745.exe
2792	Unicorn-39680.exe
2596	Unicorn-50330.exe
748	Unicorn-21114.exe
2592	Unicorn-4092.exe
212	Unicorn-1824.exe
4280	Unicorn-15171.exe
1620	Unicorn-35805.exe
3676	Unicorn-18784.exe
3432	Unicorn-53402.exe
4976	Unicorn-11705.exe
2632	Unicorn-11897.exe
4344	Unicorn-27357.exe
4892	Unicorn-11705.exe
1824	Unicorn-57377.exe
4512	Unicorn-21994.exe
2904	Unicorn-8259.exe
3264	Unicorn-25088.exe
4580	Unicorn-2659.exe
2568	Unicorn-21802.exe
3384	Unicorn-27668.exe
4028	Unicorn-19002.exe
2356	Unicorn-4985.exe
4480	Unicorn-4227.exe
2256	Unicorn-64638.exe
3500	Unicorn-9593.exe
4452	Unicorn-8031.exe
2644	Unicorn-7289.exe
3980	Unicorn-52961.exe
864	Unicorn-16426.exe
4360	Unicorn-47933.exe
4056	Unicorn-59592.exe
1956	Unicorn-1119.exe
4008	Unicorn-48929.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 8	1636	4539c8140558eceb70e4ad6249b3109127586959a89fad30b1251ece2b2ea2f2N.exe	85
PID 1636 wrote to memory of 8	1636	4539c8140558eceb70e4ad6249b3109127586959a89fad30b1251ece2b2ea2f2N.exe	85
PID 1636 wrote to memory of 8	1636	4539c8140558eceb70e4ad6249b3109127586959a89fad30b1251ece2b2ea2f2N.exe	85
PID 8 wrote to memory of 1560	8	Unicorn-41111.exe	86
PID 8 wrote to memory of 1560	8	Unicorn-41111.exe	86
PID 8 wrote to memory of 1560	8	Unicorn-41111.exe	86
PID 1636 wrote to memory of 4576	1636	4539c8140558eceb70e4ad6249b3109127586959a89fad30b1251ece2b2ea2f2N.exe	87
PID 1636 wrote to memory of 4576	1636	4539c8140558eceb70e4ad6249b3109127586959a89fad30b1251ece2b2ea2f2N.exe	87
PID 1636 wrote to memory of 4576	1636	4539c8140558eceb70e4ad6249b3109127586959a89fad30b1251ece2b2ea2f2N.exe	87
PID 1560 wrote to memory of 3920	1560	Unicorn-26519.exe	92
PID 1560 wrote to memory of 3920	1560	Unicorn-26519.exe	92
PID 1560 wrote to memory of 3920	1560	Unicorn-26519.exe	92
PID 1636 wrote to memory of 1576	1636	4539c8140558eceb70e4ad6249b3109127586959a89fad30b1251ece2b2ea2f2N.exe	93
PID 1636 wrote to memory of 1576	1636	4539c8140558eceb70e4ad6249b3109127586959a89fad30b1251ece2b2ea2f2N.exe	93
PID 1636 wrote to memory of 1576	1636	4539c8140558eceb70e4ad6249b3109127586959a89fad30b1251ece2b2ea2f2N.exe	93
PID 8 wrote to memory of 1652	8	Unicorn-41111.exe	94
PID 8 wrote to memory of 1652	8	Unicorn-41111.exe	94
PID 8 wrote to memory of 1652	8	Unicorn-41111.exe	94
PID 4576 wrote to memory of 4840	4576	Unicorn-56731.exe	96
PID 4576 wrote to memory of 4840	4576	Unicorn-56731.exe	96
PID 4576 wrote to memory of 4840	4576	Unicorn-56731.exe	96
PID 1576 wrote to memory of 4772	1576	Unicorn-2654.exe	97
PID 1576 wrote to memory of 4772	1576	Unicorn-2654.exe	97
PID 1576 wrote to memory of 4772	1576	Unicorn-2654.exe	97
PID 3920 wrote to memory of 4104	3920	Unicorn-6070.exe	98
PID 1652 wrote to memory of 1036	1652	Unicorn-3994.exe	99
PID 3920 wrote to memory of 4104	3920	Unicorn-6070.exe	98
PID 3920 wrote to memory of 4104	3920	Unicorn-6070.exe	98
PID 1652 wrote to memory of 1036	1652	Unicorn-3994.exe	99
PID 1652 wrote to memory of 1036	1652	Unicorn-3994.exe	99
PID 1636 wrote to memory of 1948	1636	4539c8140558eceb70e4ad6249b3109127586959a89fad30b1251ece2b2ea2f2N.exe	100
PID 1636 wrote to memory of 1948	1636	4539c8140558eceb70e4ad6249b3109127586959a89fad30b1251ece2b2ea2f2N.exe	100
PID 1636 wrote to memory of 1948	1636	4539c8140558eceb70e4ad6249b3109127586959a89fad30b1251ece2b2ea2f2N.exe	100
PID 1560 wrote to memory of 1372	1560	Unicorn-26519.exe	101
PID 1560 wrote to memory of 1372	1560	Unicorn-26519.exe	101
PID 1560 wrote to memory of 1372	1560	Unicorn-26519.exe	101
PID 8 wrote to memory of 4060	8	Unicorn-41111.exe	102
PID 8 wrote to memory of 4060	8	Unicorn-41111.exe	102
PID 8 wrote to memory of 4060	8	Unicorn-41111.exe	102
PID 4840 wrote to memory of 5056	4840	Unicorn-1213.exe	105
PID 4840 wrote to memory of 5056	4840	Unicorn-1213.exe	105
PID 4840 wrote to memory of 5056	4840	Unicorn-1213.exe	105
PID 4576 wrote to memory of 5076	4576	Unicorn-56731.exe	106
PID 4576 wrote to memory of 5076	4576	Unicorn-56731.exe	106
PID 4576 wrote to memory of 5076	4576	Unicorn-56731.exe	106
PID 4772 wrote to memory of 4636	4772	Unicorn-30996.exe	107
PID 4772 wrote to memory of 4636	4772	Unicorn-30996.exe	107
PID 4772 wrote to memory of 4636	4772	Unicorn-30996.exe	107
PID 4104 wrote to memory of 1012	4104	Unicorn-48977.exe	108
PID 4104 wrote to memory of 1012	4104	Unicorn-48977.exe	108
PID 4104 wrote to memory of 1012	4104	Unicorn-48977.exe	108
PID 1576 wrote to memory of 3972	1576	Unicorn-2654.exe	109
PID 1576 wrote to memory of 3972	1576	Unicorn-2654.exe	109
PID 1576 wrote to memory of 3972	1576	Unicorn-2654.exe	109
PID 1036 wrote to memory of 4064	1036	Unicorn-48977.exe	110
PID 1036 wrote to memory of 4064	1036	Unicorn-48977.exe	110
PID 1036 wrote to memory of 4064	1036	Unicorn-48977.exe	110
PID 1372 wrote to memory of 2284	1372	Unicorn-59646.exe	111
PID 1372 wrote to memory of 2284	1372	Unicorn-59646.exe	111
PID 1372 wrote to memory of 2284	1372	Unicorn-59646.exe	111
PID 1636 wrote to memory of 2336	1636	4539c8140558eceb70e4ad6249b3109127586959a89fad30b1251ece2b2ea2f2N.exe	112
PID 1636 wrote to memory of 2336	1636	4539c8140558eceb70e4ad6249b3109127586959a89fad30b1251ece2b2ea2f2N.exe	112
PID 1636 wrote to memory of 2336	1636	4539c8140558eceb70e4ad6249b3109127586959a89fad30b1251ece2b2ea2f2N.exe	112
PID 4060 wrote to memory of 5020	4060	Unicorn-7844.exe	113

C:\Users\Admin\AppData\Local\Temp\4539c8140558eceb70e4ad6249b3109127586959a89fad30b1251ece2b2ea2f2N.exe
"C:\Users\Admin\AppData\Local\Temp\4539c8140558eceb70e4ad6249b3109127586959a89fad30b1251ece2b2ea2f2N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41111.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41111.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:8
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26519.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26519.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6070.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48977.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13331.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4092.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65120.exe
        8⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11449.exe
        9⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31686.exe
        10⤵
        
        PID:8080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53885.exe
        11⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37214.exe
        11⤵
        
        PID:19176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14128.exe
        10⤵
        
        PID:10108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46916.exe
        10⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61608.exe
        9⤵
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52218.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:15216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62382.exe
        10⤵
        
        PID:17152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24212.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:11052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41322.exe
        9⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50401.exe
        8⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49949.exe
        9⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1948.exe
        10⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61614.exe
        10⤵
        
        PID:16964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52385.exe
        9⤵
        
        PID:9612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61790.exe
        9⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57387.exe
        8⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38362.exe
        9⤵
        
        PID:14212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33195.exe
        9⤵
        
        PID:9260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54033.exe
        8⤵
        
        PID:12428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43796.exe
        8⤵
        
        PID:19272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15104.exe
        7⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42394.exe
        8⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4447.exe
        9⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16538.exe
        10⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57277.exe
        11⤵
        
        PID:13560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4256.exe
        10⤵
        
        PID:12316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28548.exe
        10⤵
        
        PID:19116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1187.exe
        9⤵
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4935.exe
        9⤵
        
        PID:13288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60254.exe
        9⤵
        
        PID:17256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61608.exe
        8⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53885.exe
        9⤵
        
        PID:10360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55157.exe
        9⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8944.exe
        8⤵
        
        PID:10904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36589.exe
        8⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26279.exe
        7⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26234.exe
        8⤵
        
        PID:7672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27485.exe
        9⤵
        
        PID:12348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe
        8⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60254.exe
        8⤵
        
        PID:16580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37207.exe
        7⤵
        
        PID:8680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11299.exe
        8⤵
        
        PID:15200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55157.exe
        8⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14423.exe
        7⤵
        
        PID:11156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44439.exe
        7⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15171.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59770.exe
        7⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2233.exe
        8⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52858.exe
        9⤵
        
        PID:8808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44131.exe
        10⤵
        
        PID:16196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59019.exe
        9⤵
        
        PID:13188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21179.exe
        9⤵
        
        PID:17568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43844.exe
        8⤵
        
        PID:9204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65373.exe
        9⤵
        
        PID:12708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46446.exe
        9⤵
        
        PID:18320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17223.exe
        8⤵
        
        PID:9048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34884.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:18500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55108.exe
        7⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42461.exe
        8⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53885.exe
        9⤵
        
        PID:10852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe
        8⤵
        
        PID:11636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29845.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2727.exe
        7⤵
        
        PID:8428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42010.exe
        8⤵
        
        PID:13632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61614.exe
        8⤵
        
        PID:16620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23089.exe
        7⤵
        
        PID:12132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56206.exe
        7⤵
        
        PID:17004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1834.exe
        6⤵
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3961.exe
        7⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7484.exe
        8⤵
        
        PID:8436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40893.exe
        9⤵
        
        PID:14880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30947.exe
        8⤵
        
        PID:11776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42590.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54529.exe
        7⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17946.exe
        8⤵
        
        PID:16212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63253.exe
        8⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64395.exe
        7⤵
        
        PID:12948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60453.exe
        7⤵
        
        PID:3400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40500.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
        7⤵
        
        PID:8472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9628.exe
        8⤵
        
        PID:13448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21705.exe
        7⤵
        
        PID:12240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55989.exe
        7⤵
        
        PID:18684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34519.exe
        6⤵
        
        PID:8960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33392.exe
        7⤵
        
        PID:15536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63644.exe
        7⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37187.exe
        6⤵
        
        PID:12668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30588.exe
        6⤵
        
        PID:7288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35805.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7964.exe
        7⤵
        
        PID:656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57978.exe
        8⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 656 -s 628
        8⤵
        Program crash
        
        PID:9296
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 632
        7⤵
        Program crash
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41440.exe
        6⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60858.exe
        7⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6036 -s 628
        8⤵
        Program crash
        
        PID:8712
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 728
        6⤵
        Program crash
        
        PID:6360
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 716
        5⤵
        Program crash
        
        PID:4600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59646.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61847.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27357.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61882.exe
        7⤵
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48637.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47873.exe
        9⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52093.exe
        10⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7597.exe
        10⤵
        
        PID:7204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14506.exe
        9⤵
        
        PID:10832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7120.exe
        9⤵
        
        PID:16104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10276.exe
        9⤵
        
        PID:16852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8499.exe
        8⤵
        
        PID:9880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11033.exe
        9⤵
        
        PID:15876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57804.exe
        9⤵
        
        PID:16948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61720.exe
        8⤵
        
        PID:14004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56206.exe
        8⤵
        
        PID:16644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20899.exe
        7⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25466.exe
        8⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22685.exe
        9⤵
        
        PID:12932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23267.exe
        8⤵
        
        PID:12268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29845.exe
        8⤵
        
        PID:17448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15690.exe
        7⤵
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49914.exe
        8⤵
        
        PID:15352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57966.exe
        8⤵
        
        PID:16892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38548.exe
        7⤵
        
        PID:12200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18349.exe
        7⤵
        
        PID:18476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10688.exe
        6⤵
        
        PID:216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12508.exe
        7⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24698.exe
        8⤵
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8953.exe
        9⤵
        
        PID:11296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60356.exe
        8⤵
        
        PID:11532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19168.exe
        7⤵
        
        PID:8584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38362.exe
        8⤵
        
        PID:14320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54389.exe
        8⤵
        
        PID:17108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17223.exe
        7⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51589.exe
        7⤵
        
        PID:16796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53483.exe
        6⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32890.exe
        7⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53182.exe
        8⤵
        
        PID:18408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56737.exe
        7⤵
        
        PID:13724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36446.exe
        7⤵
        
        PID:18804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16304.exe
        6⤵
        
        PID:9952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29821.exe
        7⤵
        
        PID:14512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19447.exe
        6⤵
        
        PID:12456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36589.exe
        6⤵
        
        PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25088.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16992.exe
        6⤵
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2937.exe
        7⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39194.exe
        8⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10758.exe
        9⤵
        
        PID:17532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55157.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45368.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52887.exe
        7⤵
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30176.exe
        6⤵
        
        PID:7632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8761.exe
        7⤵
        
        PID:11044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61806.exe
        7⤵
        
        PID:16732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26695.exe
        6⤵
        
        PID:9536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26484.exe
        6⤵
        
        PID:15696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57189.exe
        6⤵
        
        PID:18616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12999.exe
        5⤵
        
        PID:5204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7545.exe
        6⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58618.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36725.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-650.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55220.exe
        6⤵
        
        PID:15856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13924.exe
        6⤵
        
        PID:6772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52657.exe
        5⤵
        
        PID:8100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53885.exe
        6⤵
        
        PID:516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24087.exe
        5⤵
        
        PID:6832
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6832 -s 636
        6⤵
        Program crash
        
        PID:13284
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13284 -s 668
        7⤵
        Program crash
        
        PID:15868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1091.exe
        5⤵
        
        PID:15764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14797.exe
        5⤵
        
        PID:18548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56485.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11705.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18528.exe
        6⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61626.exe
        7⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11484.exe
        8⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53885.exe
        9⤵
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55157.exe
        9⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53985.exe
        8⤵
        
        PID:8612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49928.exe
        8⤵
        
        PID:14540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56949.exe
        8⤵
        
        PID:19188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33056.exe
        7⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41917.exe
        8⤵
        
        PID:13768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13197.exe
        8⤵
        
        PID:18380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47848.exe
        7⤵
        
        PID:10824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3725.exe
        7⤵
        
        PID:1452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31200.exe
        6⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16893.exe
        7⤵
        
        PID:8068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56675.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30093.exe
        8⤵
        
        PID:8268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52385.exe
        7⤵
        
        PID:9844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39326.exe
        8⤵
        
        PID:8480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39061.exe
        7⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31341.exe
        6⤵
        
        PID:8656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14553.exe
        7⤵
        
        PID:14496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63617.exe
        7⤵
        
        PID:16372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15869.exe
        7⤵
        
        PID:16712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23089.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57742.exe
        6⤵
        
        PID:7700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13955.exe
        5⤵
        
        PID:5048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48762.exe
        6⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2201.exe
        7⤵
        
        PID:7180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14329.exe
        8⤵
        
        PID:13132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57804.exe
        8⤵
        
        PID:16956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48737.exe
        7⤵
        
        PID:11560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44894.exe
        7⤵
        
        PID:16744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17606.exe
        6⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42202.exe
        7⤵
        
        PID:13404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32397.exe
        7⤵
        
        PID:6476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17223.exe
        6⤵
        
        PID:12028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52357.exe
        6⤵
        
        PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6698.exe
        5⤵
        
        PID:6656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32925.exe
        6⤵
        
        PID:10716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17187.exe
        6⤵
        
        PID:14748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25044.exe
        5⤵
        
        PID:10144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34941.exe
        6⤵
        
        PID:13872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54389.exe
        6⤵
        
        PID:17124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27008.exe
        5⤵
        
        PID:14452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6893.exe
        5⤵
        
        PID:5280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27668.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33821.exe
        5⤵
        
        PID:4516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13596.exe
        6⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21306.exe
        7⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6952 -s 652
        7⤵
        Program crash
        
        PID:14596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53985.exe
        6⤵
        
        PID:8984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58682.exe
        7⤵
        
        PID:14352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30576.exe
        6⤵
        
        PID:14516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30395.exe
        6⤵
        
        PID:6704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40835.exe
        5⤵
        
        PID:8172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64641.exe
        6⤵
        
        PID:14380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34666.exe
        5⤵
        
        PID:10296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65373.exe
        6⤵
        
        PID:14664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32330.exe
        6⤵
        
        PID:19108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27086.exe
        5⤵
        
        PID:16972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10199.exe
      4⤵
      PID:5212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19165.exe
        5⤵
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4284.exe
        6⤵
        
        PID:11016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15651.exe
        6⤵
        
        PID:13572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29588.exe
        5⤵
        
        PID:9876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40803.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26154.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26154.exe
      4⤵
      PID:10120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26394.exe
        5⤵
        
        PID:15844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13652.exe
        5⤵
        
        PID:4084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64659.exe
      4⤵
      PID:15620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13276.exe
      4⤵
      PID:16588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3994.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3994.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48977.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62039.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21114.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51773.exe
        7⤵
        Executes dropped EXE
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27101.exe
        8⤵
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2201.exe
        9⤵
        
        PID:7988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52093.exe
        10⤵
        
        PID:12944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56907.exe
        10⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe
        9⤵
        
        PID:11268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10595.exe
        8⤵
        
        PID:9112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39523.exe
        9⤵
        
        PID:15864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26932.exe
        9⤵
        
        PID:18396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17415.exe
        8⤵
        
        PID:11012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7204.exe
        8⤵
        
        PID:16816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28771.exe
        7⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49949.exe
        8⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39706.exe
        9⤵
        
        PID:12872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28676.exe
        9⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50664.exe
        8⤵
        
        PID:11932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52357.exe
        8⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57387.exe
        7⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29821.exe
        8⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56529.exe
        7⤵
        
        PID:11208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35053.exe
        7⤵
        
        PID:1312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46625.exe
        6⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9337.exe
        7⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31686.exe
        8⤵
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42202.exe
        9⤵
        
        PID:13328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26695.exe
        8⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19783.exe
        9⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30592.exe
        8⤵
        
        PID:13912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11725.exe
        8⤵
        
        PID:18216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61608.exe
        7⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34432.exe
        8⤵
        
        PID:12336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61214.exe
        8⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6448.exe
        7⤵
        
        PID:9484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe
        6⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29306.exe
        7⤵
        
        PID:8452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12835.exe
        8⤵
        
        PID:14688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13995.exe
        8⤵
        
        PID:18244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48737.exe
        7⤵
        
        PID:11608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48277.exe
        7⤵
        
        PID:8204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8592.exe
        6⤵
        
        PID:8444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44740.exe
        7⤵
        
        PID:15228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-907.exe
        7⤵
        
        PID:6968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15191.exe
        6⤵
        
        PID:10960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27086.exe
        6⤵
        
        PID:16988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1824.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34970.exe
        6⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25373.exe
        7⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-633.exe
        8⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22144.exe
        9⤵
        
        PID:13492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55157.exe
        9⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8515.exe
        8⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52414.exe
        9⤵
        
        PID:18588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30602.exe
        8⤵
        
        PID:14652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4058.exe
        8⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44801.exe
        7⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56675.exe
        8⤵
        
        PID:13600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exe
        8⤵
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18346.exe
        7⤵
        
        PID:11056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36228.exe
        7⤵
        
        PID:16760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20899.exe
        6⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24506.exe
        7⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52093.exe
        8⤵
        
        PID:9912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6829.exe
        8⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe
        7⤵
        
        PID:11628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32711.exe
        6⤵
        
        PID:8672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59581.exe
        7⤵
        
        PID:13888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42189.exe
        7⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4723.exe
        6⤵
        
        PID:12364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36589.exe
        6⤵
        
        PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53640.exe
        5⤵
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3961.exe
        6⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46653.exe
        7⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39194.exe
        8⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9163.exe
        8⤵
        
        PID:16484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3907.exe
        7⤵
        
        PID:8648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23197.exe
        8⤵
        
        PID:16032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17037.exe
        8⤵
        
        PID:19136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49928.exe
        7⤵
        
        PID:14564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52574.exe
        7⤵
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6912.exe
        6⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4256.exe
        7⤵
        
        PID:12544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43691.exe
        6⤵
        
        PID:2200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28788.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24132.exe
        6⤵
        
        PID:18368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50801.exe
        5⤵
        
        PID:6620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49949.exe
        6⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7417.exe
        7⤵
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40653.exe
        7⤵
        
        PID:16772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50664.exe
        6⤵
        
        PID:11900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52357.exe
        6⤵
        
        PID:16392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28541.exe
        5⤵
        
        PID:4276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8953.exe
        6⤵
        
        PID:10076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36388.exe
        6⤵
        
        PID:18792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28832.exe
        5⤵
        
        PID:12500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55388.exe
        5⤵
        
        PID:6692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53402.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61306.exe
        6⤵
        
        PID:1400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49213.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12828.exe
        8⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50660.exe
        9⤵
        
        PID:12392
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5612 -s 624
        8⤵
        Program crash
        
        PID:9156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40224.exe
        6⤵
        
        PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33280.exe
        5⤵
        
        PID:3376
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 628
        6⤵
        Program crash
        
        PID:6780
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 748
        5⤵
        Program crash
        
        PID:6740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21802.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19322.exe
        5⤵
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60000.exe
        6⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4256.exe
        7⤵
        
        PID:10252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15028.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53985.exe
        6⤵
        
        PID:9132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49928.exe
        6⤵
        
        PID:14556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46337.exe
        5⤵
        
        PID:8012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-188.exe
        6⤵
        
        PID:13244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36725.exe
        6⤵
        
        PID:17624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-583.exe
        5⤵
        
        PID:9608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52357.exe
        5⤵
        
        PID:16400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17494.exe
      4⤵
      PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46432.exe
        5⤵
        
        PID:6488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29306.exe
        6⤵
        
        PID:8460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42202.exe
        7⤵
        
        PID:13360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exe
        7⤵
        
        PID:7896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59019.exe
        6⤵
        
        PID:13144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33924.exe
        6⤵
        
        PID:17616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9184.exe
        5⤵
        
        PID:9456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4935.exe
        5⤵
        
        PID:13140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7738.exe
      4⤵
      PID:7224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53885.exe
        5⤵
        
        PID:9364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53057.exe
        5⤵
        
        PID:15880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42412.exe
        5⤵
        
        PID:8236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26659.exe
      4⤵
      PID:9476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6729.exe
      4⤵
      PID:14464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27283.exe
      4⤵
      PID:19200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7844.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7844.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62615.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11705.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20858.exe
        6⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27709.exe
        7⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21306.exe
        8⤵
        
        PID:10860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46948.exe
        7⤵
        
        PID:10064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29808.exe
        7⤵
        
        PID:14444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42014.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22324.exe
        6⤵
        
        PID:8932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46691.exe
        7⤵
        
        PID:14056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23979.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2135.exe
        6⤵
        
        PID:14080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27373.exe
        6⤵
        
        PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9258.exe
        5⤵
        
        PID:5692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15901.exe
        6⤵
        
        PID:7268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32122.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12839.exe
        7⤵
        
        PID:14408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3581.exe
        7⤵
        
        PID:18568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32259.exe
        6⤵
        
        PID:9468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41661.exe
        7⤵
        
        PID:16108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18324.exe
        7⤵
        
        PID:18080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8999.exe
        6⤵
        
        PID:15496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52917.exe
        6⤵
        
        PID:7900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24241.exe
        5⤵
        
        PID:7392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe
        6⤵
        
        PID:16124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-509.exe
        6⤵
        
        PID:18268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18935.exe
        5⤵
        
        PID:11300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27086.exe
        5⤵
        
        PID:16672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8259.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33821.exe
        5⤵
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55293.exe
        6⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26234.exe
        7⤵
        
        PID:1400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36765.exe
        8⤵
        
        PID:10740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61214.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2307.exe
        7⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60254.exe
        7⤵
        
        PID:1124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35971.exe
        6⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26650.exe
        7⤵
        
        PID:14040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49518.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48168.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52357.exe
        6⤵
        
        PID:16564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26989.exe
        5⤵
        
        PID:6908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42202.exe
        6⤵
        
        PID:13412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47655.exe
        7⤵
        
        PID:8092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60965.exe
        6⤵
        
        PID:14228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6448.exe
        5⤵
        
        PID:9680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63992.exe
        5⤵
        
        PID:15824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55365.exe
        5⤵
        
        PID:7432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12999.exe
      4⤵
      PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23005.exe
        5⤵
        
        PID:7144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16538.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64314.exe
        7⤵
        
        PID:14308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36725.exe
        7⤵
        
        PID:16872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36928.exe
        6⤵
        
        PID:12260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8390.exe
        5⤵
        
        PID:9716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59642.exe
        6⤵
        
        PID:16012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32973.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31463.exe
        5⤵
        
        PID:13960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15677.exe
        5⤵
        
        PID:17404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52657.exe
      4⤵
      PID:8044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34432.exe
        5⤵
        
        PID:11604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61022.exe
        5⤵
        
        PID:16556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4387.exe
      4⤵
      PID:9564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62301.exe
      4⤵
      PID:5512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62350.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62350.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11897.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48097.exe
        5⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2723.exe
        6⤵
        
        PID:8200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32026.exe
        7⤵
        
        PID:13460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-774.exe
        8⤵
        
        PID:18628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52517.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8199.exe
        6⤵
        
        PID:12652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21179.exe
        6⤵
        
        PID:17964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57579.exe
        5⤵
        
        PID:9212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61022.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54033.exe
        5⤵
        
        PID:12460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46769.exe
      4⤵
      PID:6452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2723.exe
        5⤵
        
        PID:6652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29280.exe
        6⤵
        
        PID:15236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47052.exe
        6⤵
        
        PID:18416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54385.exe
        5⤵
        
        PID:12636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52357.exe
        5⤵
        
        PID:1908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28541.exe
      4⤵
      PID:7848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58682.exe
        5⤵
        
        PID:15516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6164.exe
        5⤵
        
        PID:16316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28832.exe
      4⤵
      PID:12688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31356.exe
      4⤵
      PID:5484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19002.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19002.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3836.exe
      4⤵
      PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19165.exe
        5⤵
        
        PID:6928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4124.exe
        6⤵
        
        PID:8952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38938.exe
        7⤵
        
        PID:12444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21705.exe
        6⤵
        
        PID:12224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31363.exe
        5⤵
        
        PID:9108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4935.exe
        5⤵
        
        PID:13196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28734.exe
        5⤵
        
        PID:5292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22324.exe
      4⤵
      PID:8816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9628.exe
        5⤵
        
        PID:13712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54389.exe
        5⤵
        
        PID:17224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51585.exe
      4⤵
      PID:12624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61102.exe
      4⤵
      PID:8332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59393.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59393.exe
    3⤵
    PID:1912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18973.exe
      4⤵
      PID:6944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32122.exe
        5⤵
        
        PID:9700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23197.exe
        6⤵
        
        PID:16048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59211.exe
        6⤵
        
        PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46938.exe
        5⤵
        
        PID:16148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57381.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:18332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31488.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20743.exe
        5⤵
        
        PID:7904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29808.exe
      4⤵
      PID:14476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20260.exe
      4⤵
      PID:1808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57677.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57677.exe
    3⤵
    PID:7612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38618.exe
      4⤵
      PID:10572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46133.exe
      4⤵
      PID:7656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4623.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4623.exe
    3⤵
    PID:10132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59323.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59323.exe
    3⤵
    PID:15644
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56731.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56731.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1213.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1213.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35511.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40221.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4985.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10717.exe
        7⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16995.exe
        8⤵
        
        PID:7792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38362.exe
        9⤵
        
        PID:14172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36725.exe
        9⤵
        
        PID:16432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29588.exe
        8⤵
        
        PID:10272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33834.exe
        7⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53885.exe
        8⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55157.exe
        8⤵
        
        PID:16476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14419.exe
        7⤵
        
        PID:11508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50181.exe
        7⤵
        
        PID:7860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51812.exe
        6⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39834.exe
        7⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62458.exe
        8⤵
        
        PID:11280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23979.exe
        8⤵
        
        PID:17508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55329.exe
        7⤵
        
        PID:8548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49928.exe
        7⤵
        
        PID:14548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6363.exe
        7⤵
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26698.exe
        6⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52093.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23979.exe
        7⤵
        
        PID:17576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32753.exe
        6⤵
        
        PID:8820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2551.exe
        6⤵
        
        PID:15664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18349.exe
        6⤵
        
        PID:18468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4227.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23738.exe
        6⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53178.exe
        7⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25440.exe
        8⤵
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5113.exe
        9⤵
        
        PID:14204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61614.exe
        9⤵
        
        PID:16980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24803.exe
        8⤵
        
        PID:11916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17606.exe
        7⤵
        
        PID:8736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27293.exe
        8⤵
        
        PID:14068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46155.exe
        8⤵
        
        PID:17188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17223.exe
        7⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4609.exe
        7⤵
        
        PID:16880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11875.exe
        6⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42461.exe
        7⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56675.exe
        8⤵
        
        PID:13612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exe
        8⤵
        
        PID:16548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48737.exe
        7⤵
        
        PID:11616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1255.exe
        7⤵
        
        PID:14880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3508.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31341.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42202.exe
        7⤵
        
        PID:13420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9325.exe
        7⤵
        
        PID:4428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23089.exe
        6⤵
        
        PID:11224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47108.exe
        6⤵
        
        PID:6684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-778.exe
        5⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27901.exe
        6⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5852.exe
        7⤵
        
        PID:8852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8953.exe
        8⤵
        
        PID:8788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24525.exe
        8⤵
        
        PID:16932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34432.exe
        7⤵
        
        PID:12700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17632.exe
        6⤵
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54389.exe
        7⤵
        
        PID:17240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4935.exe
        6⤵
        
        PID:13160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51998.exe
        6⤵
        
        PID:6216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41972.exe
        5⤵
        
        PID:7492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53885.exe
        6⤵
        
        PID:9372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24663.exe
        5⤵
        
        PID:10060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36992.exe
        5⤵
        
        PID:12032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51740.exe
        5⤵
        
        PID:16684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3526.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7289.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30941.exe
        6⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30944.exe
        7⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53885.exe
        8⤵
        
        PID:10348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9163.exe
        8⤵
        
        PID:16572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28423.exe
        7⤵
        
        PID:10168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9798.exe
        8⤵
        
        PID:16640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52248.exe
        7⤵
        
        PID:14488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53611.exe
        7⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22179.exe
        6⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54746.exe
        7⤵
        
        PID:10908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60254.exe
        7⤵
        
        PID:17216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28423.exe
        6⤵
        
        PID:10052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1948.exe
        7⤵
        
        PID:15244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52056.exe
        6⤵
        
        PID:14420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59854.exe
        6⤵
        
        PID:6732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36259.exe
        5⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7545.exe
        6⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4256.exe
        7⤵
        
        PID:11276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5443.exe
        6⤵
        
        PID:10200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29808.exe
        6⤵
        
        PID:14468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13274.exe
        6⤵
        
        PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42350.exe
        5⤵
        
        PID:7664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13497.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10531.exe
        6⤵
        
        PID:14792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47052.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32753.exe
        5⤵
        
        PID:9260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17626.exe
        5⤵
        
        PID:15776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16426.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15481.exe
        5⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21277.exe
        6⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11324.exe
        7⤵
        
        PID:8540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55139.exe
        8⤵
        
        PID:12328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21705.exe
        7⤵
        
        PID:12232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55989.exe
        7⤵
        
        PID:18652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5795.exe
        6⤵
        
        PID:9244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17946.exe
        7⤵
        
        PID:16184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4628.exe
        7⤵
        
        PID:16768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4935.exe
        6⤵
        
        PID:13212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        6⤵
        
        PID:18284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33056.exe
        5⤵
        
        PID:8108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13369.exe
        6⤵
        
        PID:13200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29588.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35821.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55860.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33690.exe
        5⤵
        
        PID:7340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62458.exe
        6⤵
        
        PID:12136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52414.exe
        7⤵
        
        PID:18700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4628.exe
        6⤵
        
        PID:17592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53121.exe
        5⤵
        
        PID:9824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25968.exe
        5⤵
        
        PID:15520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63669.exe
        5⤵
        
        PID:16520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15575.exe
      4⤵
      PID:8256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32026.exe
        5⤵
        
        PID:12632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2400.exe
      4⤵
      PID:12276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39929.exe
      4⤵
      PID:512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32094.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32094.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23392.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8031.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16826.exe
        6⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51261.exe
        7⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53885.exe
        8⤵
        
        PID:10316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13076.exe
        8⤵
        
        PID:16864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1418.exe
        7⤵
        
        PID:10256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6893.exe
        7⤵
        
        PID:16500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13155.exe
        6⤵
        
        PID:7684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53885.exe
        7⤵
        
        PID:8652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7037.exe
        8⤵
        
        PID:1104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55157.exe
        7⤵
        
        PID:6048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26887.exe
        6⤵
        
        PID:9320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30592.exe
        6⤵
        
        PID:12216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29079.exe
        6⤵
        
        PID:19156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29632.exe
        5⤵
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64608.exe
        6⤵
        
        PID:7208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32122.exe
        7⤵
        
        PID:9780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21978.exe
        7⤵
        
        PID:6556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32259.exe
        6⤵
        
        PID:9488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8999.exe
        6⤵
        
        PID:14572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26932.exe
        5⤵
        
        PID:8588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51194.exe
        6⤵
        
        PID:16156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13995.exe
        6⤵
        
        PID:18812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37111.exe
        5⤵
        
        PID:12884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27086.exe
        5⤵
        
        PID:16996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52961.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15455.exe
        5⤵
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51261.exe
        6⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30560.exe
        7⤵
        
        PID:9688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32026.exe
        8⤵
        
        PID:14256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13995.exe
        8⤵
        
        PID:18200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48481.exe
        7⤵
        
        PID:13668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16724.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5443.exe
        6⤵
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40893.exe
        7⤵
        
        PID:15748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-715.exe
        7⤵
        
        PID:8160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15335.exe
        6⤵
        
        PID:14636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53468.exe
        6⤵
        
        PID:16812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49476.exe
        5⤵
        
        PID:7748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58813.exe
        6⤵
        
        PID:12648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46923.exe
        6⤵
        
        PID:7420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14128.exe
        5⤵
        
        PID:10280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63992.exe
        5⤵
        
        PID:16188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3533.exe
        5⤵
        
        PID:6020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43368.exe
      4⤵
      PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64608.exe
        5⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4284.exe
        6⤵
        
        PID:11024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42339.exe
        5⤵
        
        PID:9344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35018.exe
        5⤵
        
        PID:14844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39892.exe
      4⤵
      PID:7476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39612.exe
        5⤵
        
        PID:6096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5754.exe
      4⤵
      PID:11500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14454.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57745.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57745.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9593.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42694.exe
        5⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49949.exe
        6⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-313.exe
        7⤵
        
        PID:14236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46155.exe
        7⤵
        
        PID:17232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-394.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52357.exe
        6⤵
        
        PID:7772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31341.exe
        5⤵
        
        PID:2344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40893.exe
        6⤵
        
        PID:14772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32330.exe
        6⤵
        
        PID:19164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23089.exe
        5⤵
        
        PID:12180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29632.exe
      4⤵
      PID:5784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18375.exe
        5⤵
        
        PID:7560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42202.exe
        6⤵
        
        PID:13336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27601.exe
        5⤵
        
        PID:12284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42855.exe
        6⤵
        
        PID:16724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44036.exe
        5⤵
        
        PID:4632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46792.exe
      4⤵
      PID:8016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62458.exe
        5⤵
        
        PID:12144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46901.exe
        5⤵
        
        PID:8576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56785.exe
      4⤵
      PID:9576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17626.exe
      4⤵
      PID:15804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63269.exe
      4⤵
      PID:18604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64638.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64638.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13177.exe
      4⤵
      PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1546.exe
        5⤵
        
        PID:7260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34330.exe
        6⤵
        
        PID:13584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15620.exe
        6⤵
        
        PID:16612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35281.exe
        5⤵
        
        PID:11592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63992.exe
        5⤵
        
        PID:14732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35821.exe
        5⤵
        
        PID:5508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13155.exe
      4⤵
      PID:7692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42202.exe
        5⤵
        
        PID:13396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exe
        5⤵
        
        PID:16460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29588.exe
      4⤵
      PID:10060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55527.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55527.exe
    3⤵
    PID:5684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23005.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53885.exe
        5⤵
        
        PID:10268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-650.exe
      4⤵
      PID:9652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39953.exe
      4⤵
      PID:15828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5668.exe
      4⤵
      PID:7216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28269.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28269.exe
    3⤵
    PID:7824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37277.exe
      4⤵
      PID:12352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54389.exe
      4⤵
      PID:17132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3087.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3087.exe
    3⤵
    PID:7712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56827.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56827.exe
    3⤵
    PID:15732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12749.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12749.exe
    3⤵
    PID:18488
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2654.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2654.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30996.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30996.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48692.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50330.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1119.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23069.exe
        7⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7545.exe
        8⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62458.exe
        9⤵
        
        PID:12020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26932.exe
        9⤵
        
        PID:18356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50920.exe
        8⤵
        
        PID:9504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30592.exe
        8⤵
        
        PID:13972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21709.exe
        8⤵
        
        PID:17520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36331.exe
        7⤵
        
        PID:8356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28829.exe
        8⤵
        
        PID:13116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3211.exe
        8⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58353.exe
        7⤵
        
        PID:11956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59876.exe
        8⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19693.exe
        7⤵
        
        PID:16832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17063.exe
        6⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26234.exe
        7⤵
        
        PID:7508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56675.exe
        8⤵
        
        PID:13592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exe
        8⤵
        
        PID:16452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54689.exe
        7⤵
        
        PID:8716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44920.exe
        6⤵
        
        PID:9860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42855.exe
        7⤵
        
        PID:17584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12128.exe
        6⤵
        
        PID:13932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65470.exe
        7⤵
        
        PID:7960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43671.exe
        6⤵
        
        PID:8284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48929.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7609.exe
        6⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33690.exe
        7⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24349.exe
        8⤵
        
        PID:8484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16867.exe
        8⤵
        
        PID:14644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13995.exe
        8⤵
        
        PID:18236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53121.exe
        7⤵
        
        PID:9584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65373.exe
        8⤵
        
        PID:15340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49518.exe
        8⤵
        
        PID:18436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10643.exe
        7⤵
        
        PID:13524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22715.exe
        7⤵
        
        PID:16940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20291.exe
        6⤵
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44740.exe
        7⤵
        
        PID:15220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55157.exe
        7⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44683.exe
        6⤵
        
        PID:11576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7012.exe
        6⤵
        
        PID:17144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35496.exe
        5⤵
        
        PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32564.exe
        5⤵
        
        PID:7720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23546.exe
        6⤵
        
        PID:11556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9163.exe
        6⤵
        
        PID:4492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4387.exe
        5⤵
        
        PID:9616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36857.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57377.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34589.exe
        5⤵
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2937.exe
        6⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62458.exe
        7⤵
        
        PID:12040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55500.exe
        7⤵
        
        PID:17496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50920.exe
        6⤵
        
        PID:9516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11024.exe
        6⤵
        
        PID:15712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10852.exe
        6⤵
        
        PID:7736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45444.exe
        5⤵
        
        PID:7648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21306.exe
        6⤵
        
        PID:10868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61022.exe
        6⤵
        
        PID:16536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50920.exe
        5⤵
        
        PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30592.exe
        5⤵
        
        PID:15388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14797.exe
        5⤵
        
        PID:18556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11629.exe
      4⤵
      PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53757.exe
        5⤵
        
        PID:6204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44669.exe
        6⤵
        
        PID:11936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39232.exe
        6⤵
        
        PID:15416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23979.exe
        6⤵
        
        PID:17464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38161.exe
        5⤵
        
        PID:10096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52657.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12067.exe
        5⤵
        
        PID:15308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22868.exe
        5⤵
        
        PID:5272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47160.exe
      4⤵
      PID:10352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27715.exe
      4⤵
      PID:15968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60791.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:18512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59003.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59003.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18784.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7964.exe
        5⤵
        
        PID:728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3193.exe
        6⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5732 -s 636
        7⤵
        Program crash
        
        PID:8880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15715.exe
        5⤵
        
        PID:6544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19802.exe
        6⤵
        
        PID:8836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59773.exe
        7⤵
        
        PID:13484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40653.exe
        7⤵
        
        PID:17208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49700.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35221.exe
        6⤵
        
        PID:16660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21066.exe
        5⤵
        
        PID:9028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45777.exe
        5⤵
        
        PID:12876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3533.exe
        5⤵
        
        PID:5956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42976.exe
      4⤵
      PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9244.exe
        5⤵
        
        PID:4660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24672.exe
        6⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55165.exe
        7⤵
        
        PID:1136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53067.exe
        7⤵
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe
        6⤵
        
        PID:11068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        5⤵
        
        PID:9828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25626.exe
        6⤵
        
        PID:4680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17037.exe
        6⤵
        
        PID:18776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37329.exe
        5⤵
        
        PID:13940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47173.exe
        5⤵
        
        PID:7428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44936.exe
      4⤵
      PID:6628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11324.exe
        5⤵
        
        PID:8552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26650.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33165.exe
        6⤵
        
        PID:9444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30947.exe
        5⤵
        
        PID:11784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52766.exe
        5⤵
        
        PID:6520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25396.exe
      4⤵
      PID:8776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22144.exe
      4⤵
      PID:13916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11382.exe
      4⤵
      PID:6752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21994.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21994.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3836.exe
      4⤵
      PID:776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22618.exe
        5⤵
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2201.exe
        6⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6649.exe
        7⤵
        
        PID:12808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe
        6⤵
        
        PID:8316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17606.exe
        5⤵
        
        PID:8696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32682.exe
        5⤵
        
        PID:12208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30627.exe
      4⤵
      PID:6988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7619.exe
        5⤵
        
        PID:10636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55157.exe
        5⤵
        
        PID:6268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19178.exe
      4⤵
      PID:10160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41661.exe
        5⤵
        
        PID:15720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46446.exe
        5⤵
        
        PID:18312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35674.exe
      4⤵
      PID:14432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48284.exe
      4⤵
      PID:19096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34324.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34324.exe
    3⤵
    PID:5160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39834.exe
      4⤵
      PID:7120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32122.exe
        5⤵
        
        PID:9772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6976.exe
        5⤵
        
        PID:13676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56289.exe
      4⤵
      PID:8224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43762.exe
        5⤵
        
        PID:18428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49928.exe
      4⤵
      PID:14532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32606.exe
      4⤵
      PID:18640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43992.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43992.exe
    3⤵
    PID:8024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9628.exe
      4⤵
      PID:13820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7552.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7552.exe
    3⤵
    PID:8448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53181.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53181.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18156.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18156.exe
    3⤵
    PID:15792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34003.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34003.exe
    3⤵
    PID:16920
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13709.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13709.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39680.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39680.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47933.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15481.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12828.exe
        6⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60570.exe
        7⤵
        
        PID:9592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40893.exe
        8⤵
        
        PID:15996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10004.exe
        8⤵
        
        PID:16700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30691.exe
        7⤵
        
        PID:13648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59890.exe
        7⤵
        
        PID:856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-650.exe
        6⤵
        
        PID:9640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39953.exe
        6⤵
        
        PID:15836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55004.exe
        6⤵
        
        PID:17388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33056.exe
        5⤵
        
        PID:8124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29853.exe
        6⤵
        
        PID:10292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55157.exe
        6⤵
        
        PID:6044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29588.exe
        5⤵
        
        PID:10568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55365.exe
        5⤵
        
        PID:1368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21760.exe
      4⤵
      PID:5948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40067.exe
        5⤵
        
        PID:8148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42202.exe
        6⤵
        
        PID:13384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exe
        6⤵
        
        PID:3976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52826.exe
        5⤵
        
        PID:9360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26797.exe
        5⤵
        
        PID:7948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20647.exe
      4⤵
      PID:7512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32122.exe
        5⤵
        
        PID:9788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17728.exe
        5⤵
        
        PID:13952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55925.exe
        5⤵
        
        PID:5540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51860.exe
      4⤵
      PID:4696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38488.exe
      4⤵
      PID:13996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63269.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:18524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59592.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59592.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15481.exe
      4⤵
      PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19165.exe
        5⤵
        
        PID:6920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53885.exe
        6⤵
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55157.exe
        6⤵
        
        PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29588.exe
        5⤵
        
        PID:9684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56206.exe
        5⤵
        
        PID:16652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46404.exe
      4⤵
      PID:7576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12025.exe
        5⤵
        
        PID:13880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42189.exe
        5⤵
        
        PID:5964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28423.exe
      4⤵
      PID:10172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52056.exe
      4⤵
      PID:15248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21709.exe
      4⤵
      PID:17540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41361.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41361.exe
    3⤵
    PID:5916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23005.exe
      4⤵
      PID:7152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43616.exe
        5⤵
        
        PID:9148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26650.exe
        6⤵
        
        PID:14020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4256.exe
        5⤵
        
        PID:11256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8390.exe
      4⤵
      PID:9724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39523.exe
        5⤵
        
        PID:15652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46155.exe
        5⤵
        
        PID:17172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31463.exe
      4⤵
      PID:13976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61179.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61179.exe
    3⤵
    PID:7840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8768.exe
      4⤵
      PID:11216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18941.exe
      4⤵
      PID:16840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7552.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7552.exe
    3⤵
    PID:9100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28943.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28943.exe
    3⤵
    PID:13776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38317.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38317.exe
    3⤵
    PID:1044
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53685.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53685.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46023.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46023.exe
    3⤵
    PID:2844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42394.exe
      4⤵
      PID:768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33690.exe
        5⤵
        
        PID:7276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36765.exe
        6⤵
        
        PID:10748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52026.exe
        7⤵
        
        PID:14348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32330.exe
        7⤵
        
        PID:19124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21027.exe
        6⤵
        
        PID:15576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12029.exe
        6⤵
        
        PID:16908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62321.exe
        5⤵
        
        PID:10952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22595.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24221.exe
        5⤵
        
        PID:9920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44683.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58833.exe
      4⤵
      PID:14780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24132.exe
      4⤵
      PID:18576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34634.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34634.exe
    3⤵
    PID:6248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23136.exe
      4⤵
      PID:7404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9163.exe
        5⤵
        
        PID:5852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54881.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-986.exe
      4⤵
      PID:8216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38577.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38577.exe
    3⤵
    PID:8688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15191.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15191.exe
    3⤵
    PID:10856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6893.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6893.exe
    3⤵
    PID:6496
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2659.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2659.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20858.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20858.exe
    3⤵
    PID:3096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9436.exe
      4⤵
      PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2201.exe
        5⤵
        
        PID:7360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26525.exe
        6⤵
        
        PID:13700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42189.exe
        6⤵
        
        PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4611.exe
        5⤵
        
        PID:11004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52628.exe
      4⤵
      PID:9508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40893.exe
        5⤵
        
        PID:16256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55157.exe
        5⤵
        
        PID:6052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21466.exe
      4⤵
      PID:14404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60197.exe
      4⤵
      PID:18228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31200.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31200.exe
    3⤵
    PID:6604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43805.exe
      4⤵
      PID:8724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42202.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exe
        5⤵
        
        PID:16468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34432.exe
      4⤵
      PID:12800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35221.exe
      4⤵
      PID:17248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36744.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36744.exe
    3⤵
    PID:9140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10800.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10800.exe
    3⤵
    PID:13744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60380.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60380.exe
    3⤵
    PID:7364
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25421.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25421.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55293.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55293.exe
    3⤵
    PID:7080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37373.exe
      4⤵
      PID:8992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11833.exe
        5⤵
        
        PID:14088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4628.exe
        5⤵
        
        PID:17632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21705.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10566.exe
        5⤵
        
        PID:18260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55989.exe
      4⤵
      PID:18676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23683.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23683.exe
    3⤵
    PID:9264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36149.exe
      4⤵
      PID:17440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4935.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4935.exe
    3⤵
    PID:13176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61022.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61022.exe
    3⤵
    PID:16440
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22991.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22991.exe
  2⤵
  PID:8032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2041.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2041.exe
    3⤵
    PID:14160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26932.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26932.exe
    3⤵
    PID:18388
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63289.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63289.exe
  2⤵
  PID:7556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30589.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30589.exe
    3⤵
    PID:15392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12459.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12459.exe
    3⤵
    PID:18088
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61028.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61028.exe
  2⤵
  PID:15752
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29933.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29933.exe
  2⤵
  PID:18536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3920 -ip 3920
1⤵
PID:1132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3984 -ip 3984
1⤵
PID:6180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1620 -ip 1620
1⤵
PID:6476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3376 -ip 3376
1⤵
PID:6528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4276 -ip 4276
1⤵
PID:6572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 5928 -ip 5928
1⤵
PID:6352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 1400 -ip 1400
1⤵
PID:7300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 2912 -ip 2912
1⤵
PID:7412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 5732 -ip 5732
1⤵
PID:7848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 6196 -ip 6196
1⤵
PID:2344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 3432 -ip 3432
1⤵
PID:7424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 6036 -ip 6036
1⤵
PID:8064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 728 -ip 728
1⤵
PID:8772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 656 -ip 656
1⤵
PID:9132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 4696 -ip 4696
1⤵
PID:7644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5612 -ip 5612
1⤵
PID:9664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 7564 -ip 7564
1⤵
PID:9372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 6952 -ip 6952
1⤵
PID:16256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 6832 -ip 6832
1⤵
PID:16208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 13284 -ip 13284
1⤵
PID:4956

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1213.exe

Filesize
468KB

MD5
35ffa3727245278f255336348714ce84

SHA1
d8dea253fed5e2368c09a875ec3afdf111ae3173

SHA256
9607167fdecd37ad7ccc09640755f4242105405161999f9e85a30059ce2b8c06

SHA512
7f59d2fc4bdf605023659f9f6adf495ae83e46cc2ece623b89170cc043f254963cc023500ce095d90350da720f1dd513e71f305262df4539d3fccfab649b65c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13331.exe

Filesize
468KB

MD5
c2ee07d6e15d36974ecbc8417f074e6b

SHA1
39fe7a50a187359a2dbd691d16a0dac5a1f27579

SHA256
0774fb15691979cf76e690ce2715a3c9ef4e022e144932749d481e9bd195e297

SHA512
40a29d4986a2ce2c87308944ba224256ecac66baecd9341dc2eb1dcb382e2e6376cac8fe8c8097f5ff6e64eed86f3ced7eca55168c60bb3fdfe2bb494671f1db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13709.exe

Filesize
468KB

MD5
c1cc8d5a92534fb41c5f5df8589ae27a

SHA1
8d108b8ab5a54af68b6333abcdce27305de3fecd

SHA256
1da1447063cef24a8bb86205a92436c4f47c8e1e9c316c61f8c236ba774cce02

SHA512
81e40db22cd7321b292c5316c69184ea6c86f493dc18e09fb2e21cccfe6177a186f8118bcc9ca68de6e2601532eb8279cff52303f51fb9ac0f20f6d8aa1de320

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21760.exe

Filesize
468KB

MD5
8e009acddb21255b8a0f6270fd8a22c9

SHA1
adfa06e63f6b77085544021d5064807140f4b773

SHA256
dbbc88fe3232d4486aadc82244406f5373bc2b27efdbdce8e917326f8d752c46

SHA512
59c715c38c8a27043873aca18680c2a0598a5234a14136ed309ab5444bfbba06ef74c6cac105e46bbad44d5d5074d3ccd5364c12648d17fa18afd7e570b07f70

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23392.exe

Filesize
468KB

MD5
d4bb53bb40e70fe52f835874e69e1ca5

SHA1
8efbd3a6dc72f552f9efe411993b1029493d83c4

SHA256
b3fa603d1d24d2438164e709ddf341e673ccb49e815aac1ec955ace3a21829f3

SHA512
3476d3c6b28ff94b0ef50acb288234f18fd274a10b0951c56019b6de32164fb5e422695eb0a346e1608483ac56ae54e3e5723583c42c4a577e9ff297c712557c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24525.exe

Filesize
468KB

MD5
94fd3754bd18fac508c896fab3450bb8

SHA1
7f2bb5139ef087fa2a7a1eb6a8f79d9bb743e4f1

SHA256
c5f01852e58de02971ba5eba08ab52a0641f1a050e33d6349110edcad0af604f

SHA512
1116b4b17750498959cebb62a37f3c786df4c1347d6d8b391f46fe719dda40c648f664a4b3cc5564df62a1db5efa9f8f06ef768e08936d07d1794ea4aec1c112

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26519.exe

Filesize
468KB

MD5
de036e86f901a76112acc358a6289c4d

SHA1
87d21936336fb62414eaf672dc09feff076e95be

SHA256
59d0372db2f2ceee241dd424d776a949795a19ef7c4b6b841b0d8e80329257b2

SHA512
f3ef94e189f515b2ee4462502f7f1f7c9128affd5b2be951a505a46c465ea0ff59c5c1927d9ecc63746ee9ada3c0e33d3fe6372eefabaa1e8f521acf7a050bf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2654.exe

Filesize
468KB

MD5
16a380d3ccb306905f7009480f433d46

SHA1
d61aa9c2dd5565d9d962cff6d10ed6b7dbca7f60

SHA256
17e2fc32b37d88c9eb3d46f2eff6da0255fdd210dc072924fb3e6dab51f4ab53

SHA512
06e077f177ca4a962b5aae7635429f50d8f922bc1acebbd51047c2d7f2b4b357b57623cf8280a0bb9cb6a73eff51e23b0ab6dc027bcb2d38f070d19840e55ce3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30996.exe

Filesize
468KB

MD5
58d97a5acd806f0b1b465c4e6611ac33

SHA1
e2e28208be87087ffdb4613538a8bdb8666d5b2b

SHA256
e756884fcbb63239b0aa19823d4652859af2e0cac984c3238e7d7fd558020ebb

SHA512
91920efe3f89e3bb6377158eebbaae35ed9eba319a978b9bd5c8838c77da47aa1e8dd870a77f1fe62c716548002d2c41a5a5d0c7a4e19471c31939936a6b581e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32094.exe

Filesize
468KB

MD5
c618745533f0a1caed47fb351ac91d11

SHA1
aeb6c7c415c6a6915c76cd1f7bf1b2b9d94d78f3

SHA256
fb0241cd9ed29541f9f5752d73598ba15927bb5dcd75cd9e4b44e094bc2a3bae

SHA512
d858416f8ca131d93a4784d9ba13d4b3732ac91c34ac7b223802452aa5260f0a4d250f4e636c5536ebd1c8b523683afc0ae01ef984dd448ab56179492b5c2f32

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3526.exe

Filesize
468KB

MD5
96d40a4caffc92f0a433f3ebc943db2d

SHA1
d69c86b398745228678e95d23990170e9b475d4b

SHA256
47a75b5cf8f9f77ceaecc14ac84465c8f1a0821ee4aa29f89c92dee68964e69c

SHA512
8010fbd91b95850ff5004940f9d435a78e0bc13be2da992eed9c51a5e6bb5a25c34ce2aa413f8ea1b60536c64963b06e8391be71c18a7e61a967712b197626e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35511.exe

Filesize
468KB

MD5
e0dd559fd991159e27f17f2901679ce7

SHA1
577691fce28baed555efff3ef04cd83a0a6a6726

SHA256
130fa3938ed83203ed3b3815afdf05d5d08dff3dd526fd2212c3f9f59fa4495a

SHA512
3ed601e85fa125ae4f9f8c367c0d45fda1f8496850b09ba99d9da8c061256839fee3cf2d4b2600c26b6ef17426e965cfeb02ac19ee65f804d638709450c54e08

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39680.exe

Filesize
468KB

MD5
51e301b04020f37c5ccd0f237d62dc44

SHA1
5e79a290539a7ef885bb02eae4be3b6756c5a30a

SHA256
4a9eceaff7cba903b86d2990af0c19b52a47b35355c4c7ac18a528dae1699677

SHA512
cb4fea777cea613c79da6e7de39455c6d967c1a1940066eae999a2a5ab93fbae98083533f67b0f2b42a578afdd0472d490fc111b8aeb6568baa882a180cd2f24

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3994.exe

Filesize
468KB

MD5
43a2b10b8f0086644e73ec6af1b420f4

SHA1
c637514e2554b7f0c9c2edefad8ed59f3c5d2988

SHA256
a2aa6f48ab207d6fae438f2c3a08f5f93e5f72e2d05051781ac81aff56c61403

SHA512
0983b7c347d2ab7663a5c305b7d0d39af80e74a201164051dbbc8175e94b1a1538c56ed3a715b745a409b94112f5e3c8f2c83b794c17bfb07e22a8091cec110e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40221.exe

Filesize
468KB

MD5
08d5229ee37f7fe1d64df08e6c41b36e

SHA1
c7e7e8bec5896fe812f3038e7c1ef086e0db9ca4

SHA256
37622319c54fda62dd053423ff65577d252fec67834d6b2e70ed57d8b5aeb7f0

SHA512
4f31bab81adf40aa094270d33c5065a952d6fdd358d3ea9dd4b5ae22f7687e39a0901e94fbc6bf83a84cb62e2b243c200380ce414ca80fe2fa10281b974f76eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41111.exe

Filesize
468KB

MD5
0373acde9a0a5c9069ddc5f037851c95

SHA1
b9a0df6d587fad47b3edb3f28f8c0604879a25c4

SHA256
43cae7fa95683ca48567382f7a0616f23147713feb1d545e6fde0246d4d73053

SHA512
a48da2b774db246c32d3a9e676cfdb4f4538389dff7b4d59976bf108d7379c9e033997ee65e338dab341368540f7faa92c0f9d9bccf7cf3b08100101b7e2db27

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48692.exe

Filesize
468KB

MD5
35c761df1c8a034fa6feaa22b54a21c1

SHA1
faf21a93b97406aa97dd98498ff49b90017f4967

SHA256
8d704e9417c31e4fcaaa3dd1ac4ff2c528a012c4133046e01361e7825dbe9165

SHA512
ff0ef344e1bf2391462cc332f41ac72dc6ed46dcbb9658b1136c48776e1e20f1f42336262a343fa7438516ca990e992ad22a34074de43765be1eee87186a4748

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48977.exe

Filesize
468KB

MD5
0145a481c9e95fdfe8fff448d444bbb0

SHA1
c70fe771d6e5cbb70971ea7a6010ef0b3014cb81

SHA256
e4d265deb0622ab389a85cfc44f1c26ad666ee1d066c1cfe835b432cc218bc4c

SHA512
990c2c074c166e8f9db08a9554bdd6084b301f176ec94629e9d1661823013cb05e6484f2fce5498cb09e0edd0c9f6ebee1c2bc787474fda46229f02d96de2e01

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50330.exe

Filesize
468KB

MD5
01da5868661f4ced4847eec7bbf5695e

SHA1
2dc68a5e6d560d708be3fff144e1acc5237d328a

SHA256
47db96f899c75a130f944fda2ba6fbabd823cf7e19db326a472389183433d5cf

SHA512
a0f1d87c7f46884bc09917a0429c290cfaf5d22eae539bb8651b4f06c41d0237ade6456fa7e9798e549052b9987e8552b6ac19996add33191a9caeb508fea49e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53685.exe

Filesize
468KB

MD5
dfe20c795337aa445542e611cb185442

SHA1
fe0af9c10c0acf8ab9baf483ee990383ddeac742

SHA256
1aab487f0401da7c039d542b349e6e0510405baf098c31025cadd768a9029a0a

SHA512
c6b734be4e99fb22befc4b2633c29f9f135c7cf13f34a9ddcb7c4cad73b8a816b0f5f97bd7857be59565de53c3c8287a73ec81383d8b896d2f32de9ae9d2621f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56485.exe

Filesize
468KB

MD5
f14c5b4a8f6ac5bb3883a9d271da3c2c

SHA1
957417c4f5a97a75a9d75f6c38004bfa59322473

SHA256
8e0a978a24da00ba57f6a39975e72913d44d0a1b65b3f13d7d2ada90bbefdaa2

SHA512
80544e31bcd1b529499d8b17a9fc7139633b2d81a27b3482b72a6112cbedb4777e5a126a28a2b07978e6a8f64ef4bfc31d9f12ab6410cca1f0ad6214f53dc41a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56731.exe

Filesize
468KB

MD5
252217e9ce4f1d03780c6122c5d77610

SHA1
3b4df5eaa6bd60f035509354bf4b4fd7ac26d8f0

SHA256
935c9ae3b8f1ad23515d502925e6f289031a87c9b5c65b67626571f8dd37e181

SHA512
bf79ed202732c30555ccecac93336368fd28f0a84c511c3f1d040fd423383340f2fb0f7e837da3e8ea3a4059628672fe2636f4d384a58a71bba3c5e4bdfed205

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57745.exe

Filesize
468KB

MD5
a89663070ebe1b80ba82a12ec817c25d

SHA1
c57a35c69ff5fa703ae5f029ab8b19cb9a5ed7ac

SHA256
52eac448f0964563d0ab7cb9e55e8e0885c066c4938ba747e24cd44017cbd65f

SHA512
03827ecea9b3de15278e6b3e651bdb2d18b01a824b51bf91c5c478a45949a0697cd51187a376fa1f0fa5a1db94b6abf061e4e4892c3b394d9f2c07aaa7149e76

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59003.exe

Filesize
468KB

MD5
2e4a79c9ae38c466d01acb4e95967631

SHA1
0d877305d12130f6f21ef08025e85f296f5c6605

SHA256
4ca7ff3e122b7f70e2d2b48b04b8d261c02a497dee375f30d932181eff86299e

SHA512
fcafbd4437145ba84ff98387c87f9ef41a4ddda41d420cd1cd9ca0d22ec83a833dbafcc3e0e90975977e65b113ddb1cc5d61a5be068c7998f6742dc1091afce4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59646.exe

Filesize
468KB

MD5
998ce7e7b74a749af0dccc22f65d9193

SHA1
efad0e313bbc0c1364537c5b6fe539e17528013f

SHA256
6a3cbc04a2bf6c5968154d2ef57aa34572785fcddc851875a32e8d3d93acb740

SHA512
d6104566ffda80c009736be39b8b2481347ac63e78aa9f727a98bd719621d19af49f3c25b1d303b29f8782f2ef043a6b7b88242f372d5a7b0058c062a2f7cf2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe

Filesize
468KB

MD5
f684ecb51853be01eb9520bf837d35fd

SHA1
8b62c1eabb3840d5dc264e3ded121ea71cb8a036

SHA256
79e87e9183631e48d4b260da555dcf786dda167e84f19560bc1f74e7762b173c

SHA512
c964ecedae7575b490e04e744814e2d5926ddd5fa946c3956ad40333560206a3cd6533daaf69190b9535832eb9e966d8a790b5de177a176823adb82dfc34ecf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6070.exe

Filesize
468KB

MD5
b6a43f70d8a7679058bbf3475bacc961

SHA1
2aafedb6c2445ac6679672e1cb2a2bd83027b289

SHA256
4c77bce20f0e23768248c562defde1e26366bf706de7d90492db4ce259c7a15b

SHA512
2d57002ee27781c4dbdc5679c403285b3e1d387d0a75bc959b4791739db872d28d5299a5467c14a6526ce98a7eed85c88fe643beb574854e660a8dd8cbc6b9a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61847.exe

Filesize
468KB

MD5
cc260508e7a3388cfca658b062369a42

SHA1
3f3f7a497b429411d23e6ec9530b3cc7218714c3

SHA256
940e0a194405bb574c0c191966f958bd071aec6bd8d2bac201dd922ca7cb1fb5

SHA512
6f021f2523d6795be6ada852c3d9705803a3149fce1ea430a8931a0993cd3ec2a106b9e97e05ab5ccc2a6448075941beb2007dc6df4c6adfb87f3f35f1ebbe46

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62039.exe

Filesize
468KB

MD5
6fc464b257d1f5537de42ed8442995eb

SHA1
e96bd477ce0a11b56f24bcdf959317f18c04033f

SHA256
576a537edfb536678edeed581e1ae9f8a078620a2be043536e17fcda28b7efbc

SHA512
32a4e439a96d09f764d68cf240d1ef2ee9299a75cd591c29fcce20be5d67252cfab938441699c4f2a8ec04642b9a88a8013f342522482af3d69ffc95d753ecd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62350.exe

Filesize
468KB

MD5
4fa33d60a4b56cd2c4b65db6a9a26c83

SHA1
edae9cdbb976bb6cdf948d231f4e82218409d048

SHA256
ff17a8221933892b6e6eb0f0088aed215138df4cda02d61a0566a04470bd6a86

SHA512
1ef0b2e8acc6bd601c4194899271dee9e1794c162a76316e221013bf4282a9bb36535df1edfc6bf9b7ebd6991b241877b1cc09e777407b06cac4d538d0f74dcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62615.exe

Filesize
468KB

MD5
c8366de81285e5a3092578ed5f8ac80d

SHA1
b81b815894f24371bca28cda5e38dde4de72f7c3

SHA256
85e7ce03d4e5d8c5bc898b8fb7ed4df33da640d0036333545e40bc8cffe9893f

SHA512
be81957c0689d49ac10b30175745986e42ee059d17e66d2d20e2b9449e9979c4149fc2c57e106285acaf320bcada65dd0683321b2d2ed5043d9ea5e5ded5eb80

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7844.exe

Filesize
468KB

MD5
fb092cca84c5fdefd023274f2a3d4129

SHA1
41c885118be4020798c261c8c8e6835f23c93afa

SHA256
9d308ba86c06102a6d032c7dda75a75dcbf6554ebf05e6af1edb0e0ce8564837

SHA512
b904bd524c7bb4439900a3f87d0d1b59a03bb601b72d64e7f870f1632c4cb82ec403119e18c44e81e2c17c6f81151c4b388d659f2ee0074c072e14bb144f0492

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads