0f7a34fad22dcead9aec5f6c4344ba2a2b7139bd80245b2a82ae6ca975dc67a9

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2024 18:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f7a34fad22dcead9aec5f6c4344ba2a2b7139bd80245b2a82ae6ca975dc67a9.exe
Size

184KB
MD5

c588dd24e0009927213e55a409a3c836
SHA1

7f211f9f67b22bda5f95dce7041e1a36a660c9f3
SHA256

0f7a34fad22dcead9aec5f6c4344ba2a2b7139bd80245b2a82ae6ca975dc67a9
SHA512

4144398d119c323103d3c6b60b295f1838848be5fb759c2968052b657bc52bc0cd8ff276000b9ec99a851f6319f418a4d3f2264b38aaaf9ec1af38dd17a7e87c
SSDEEP

3072:EPtv/TonchID5QjZWitW8x4CMlvnqnciu:EPtohdQjo8qCMlPqnciu

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4624	Unicorn-28216.exe
2784	Unicorn-49788.exe
3236	Unicorn-7364.exe
2216	Unicorn-57738.exe
2956	Unicorn-46041.exe
4312	Unicorn-369.exe
1356	Unicorn-29049.exe
3916	Unicorn-19804.exe
3004	Unicorn-8106.exe
3292	Unicorn-36140.exe
2836	Unicorn-7451.exe
3912	Unicorn-17666.exe
2916	Unicorn-28526.exe
3396	Unicorn-52211.exe
4376	Unicorn-41075.exe
3948	Unicorn-7105.exe
4056	Unicorn-60945.exe
1932	Unicorn-31610.exe
1924	Unicorn-64374.exe
3836	Unicorn-21304.exe
1308	Unicorn-60198.exe
4088	Unicorn-5522.exe
840	Unicorn-2829.exe
2340	Unicorn-6913.exe
3248	Unicorn-783.exe
4988	Unicorn-63520.exe
1516	Unicorn-56669.exe
3616	Unicorn-36270.exe
3016	Unicorn-36275.exe
3080	Unicorn-3166.exe
4628	Unicorn-20894.exe
3504	Unicorn-35184.exe
1092	Unicorn-54142.exe
848	Unicorn-42444.exe
4360	Unicorn-4941.exe
4736	Unicorn-47655.exe
2560	Unicorn-29446.exe
2208	Unicorn-33530.exe
3632	Unicorn-21832.exe
2404	Unicorn-16232.exe
1256	Unicorn-6887.exe
4912	Unicorn-53950.exe
4356	Unicorn-47820.exe
4984	Unicorn-42252.exe
4876	Unicorn-31392.exe
4444	Unicorn-33429.exe
1624	Unicorn-43644.exe
4860	Unicorn-31946.exe
1112	Unicorn-24905.exe
688	Unicorn-5304.exe
4920	Unicorn-44220.exe
4856	Unicorn-5880.exe
1772	Unicorn-25746.exe
560	Unicorn-35090.exe
4560	Unicorn-44604.exe
2212	Unicorn-42558.exe
4520	Unicorn-42466.exe
4008	Unicorn-30768.exe
3500	Unicorn-32160.exe
1020	Unicorn-35979.exe
1080	Unicorn-38766.exe
2324	Unicorn-53711.exe
5000	Unicorn-24930.exe
2728	Unicorn-24930.exe

Program crash 20 IoCs

pid	pid_target	Process	procid_target
3304	4312	WerFault.exe	100
320	3948	WerFault.exe	118
5788	4736	WerFault.exe	140
6752	4444	WerFault.exe	150
7108	228	WerFault.exe	173
7996	5404	WerFault.exe	192
10904	5260	WerFault.exe	286
10972	5692	WerFault.exe	240
11024	6100	WerFault.exe	241
11904	6380	WerFault.exe	260
14280	12304	WerFault.exe	593
14332	12412	WerFault.exe	601
12900	12420	WerFault.exe	602
15848	7656	WerFault.exe	363
17940	14556	WerFault.exe	774
19340	14512	WerFault.exe	814
13396	19136	Process not Found	1155
7108	12164	Process not Found	1198
14516	11584	Process not Found	1184
15416	15312	Process not Found	1336

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1769.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11192.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11192.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10281.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2947.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7265.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34615.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15311.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17659.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9630.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31141.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56669.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19074.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2829.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41864.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20304.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46195.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27044.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36889.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40965.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51630.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14813.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14737.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19768.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3583.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5120.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60912.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40394.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52393.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50855.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44578.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49408.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47496.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50376.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20984.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5983.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43789.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63182.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20072.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44616.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5566.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5138.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19797.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9535.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30768.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	19228	dwm.exe
Token: SeChangeNotifyPrivilege	19228	dwm.exe
Token: 33	19228	dwm.exe
Token: SeIncBasePriorityPrivilege	19228	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2380	0f7a34fad22dcead9aec5f6c4344ba2a2b7139bd80245b2a82ae6ca975dc67a9.exe
4624	Unicorn-28216.exe
2784	Unicorn-49788.exe
3236	Unicorn-7364.exe
2216	Unicorn-57738.exe
2956	Unicorn-46041.exe
4312	Unicorn-369.exe
1356	Unicorn-29049.exe
3916	Unicorn-19804.exe
3004	Unicorn-8106.exe
3292	Unicorn-36140.exe
2916	Unicorn-28526.exe
3396	Unicorn-52211.exe
3912	Unicorn-17666.exe
4376	Unicorn-41075.exe
3948	Unicorn-7105.exe
4056	Unicorn-60945.exe
1932	Unicorn-31610.exe
1924	Unicorn-64374.exe
3836	Unicorn-21304.exe
1308	Unicorn-60198.exe
4988	Unicorn-63520.exe
1516	Unicorn-56669.exe
4088	Unicorn-5522.exe
840	Unicorn-2829.exe
2340	Unicorn-6913.exe
3248	Unicorn-783.exe
3616	Unicorn-36270.exe
3016	Unicorn-36275.exe
3080	Unicorn-3166.exe
4628	Unicorn-20894.exe
3504	Unicorn-35184.exe
1092	Unicorn-54142.exe
848	Unicorn-42444.exe
4360	Unicorn-4941.exe
4736	Unicorn-47655.exe
2560	Unicorn-29446.exe
2208	Unicorn-33530.exe
3632	Unicorn-21832.exe
1256	Unicorn-6887.exe
2404	Unicorn-16232.exe
4984	Unicorn-42252.exe
4876	Unicorn-31392.exe
4912	Unicorn-53950.exe
4356	Unicorn-47820.exe
4444	Unicorn-33429.exe
4860	Unicorn-31946.exe
688	Unicorn-5304.exe
1112	Unicorn-24905.exe
1624	Unicorn-43644.exe
4920	Unicorn-44220.exe
560	Unicorn-35090.exe
4856	Unicorn-5880.exe
1772	Unicorn-25746.exe
2212	Unicorn-42558.exe
4560	Unicorn-44604.exe
4520	Unicorn-42466.exe
4008	Unicorn-30768.exe
1020	Unicorn-35979.exe
3500	Unicorn-32160.exe
1080	Unicorn-38766.exe
2324	Unicorn-53711.exe
2976	Unicorn-52964.exe
5000	Unicorn-24930.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 4624	2380	0f7a34fad22dcead9aec5f6c4344ba2a2b7139bd80245b2a82ae6ca975dc67a9.exe	89
PID 2380 wrote to memory of 4624	2380	0f7a34fad22dcead9aec5f6c4344ba2a2b7139bd80245b2a82ae6ca975dc67a9.exe	89
PID 2380 wrote to memory of 4624	2380	0f7a34fad22dcead9aec5f6c4344ba2a2b7139bd80245b2a82ae6ca975dc67a9.exe	89
PID 4624 wrote to memory of 2784	4624	Unicorn-28216.exe	94
PID 4624 wrote to memory of 2784	4624	Unicorn-28216.exe	94
PID 4624 wrote to memory of 2784	4624	Unicorn-28216.exe	94
PID 2380 wrote to memory of 3236	2380	0f7a34fad22dcead9aec5f6c4344ba2a2b7139bd80245b2a82ae6ca975dc67a9.exe	95
PID 2380 wrote to memory of 3236	2380	0f7a34fad22dcead9aec5f6c4344ba2a2b7139bd80245b2a82ae6ca975dc67a9.exe	95
PID 2380 wrote to memory of 3236	2380	0f7a34fad22dcead9aec5f6c4344ba2a2b7139bd80245b2a82ae6ca975dc67a9.exe	95
PID 2784 wrote to memory of 2216	2784	Unicorn-49788.exe	98
PID 2784 wrote to memory of 2216	2784	Unicorn-49788.exe	98
PID 2784 wrote to memory of 2216	2784	Unicorn-49788.exe	98
PID 4624 wrote to memory of 2956	4624	Unicorn-28216.exe	99
PID 4624 wrote to memory of 2956	4624	Unicorn-28216.exe	99
PID 4624 wrote to memory of 2956	4624	Unicorn-28216.exe	99
PID 3236 wrote to memory of 4312	3236	Unicorn-7364.exe	100
PID 3236 wrote to memory of 4312	3236	Unicorn-7364.exe	100
PID 3236 wrote to memory of 4312	3236	Unicorn-7364.exe	100
PID 2380 wrote to memory of 1356	2380	0f7a34fad22dcead9aec5f6c4344ba2a2b7139bd80245b2a82ae6ca975dc67a9.exe	101
PID 2380 wrote to memory of 1356	2380	0f7a34fad22dcead9aec5f6c4344ba2a2b7139bd80245b2a82ae6ca975dc67a9.exe	101
PID 2380 wrote to memory of 1356	2380	0f7a34fad22dcead9aec5f6c4344ba2a2b7139bd80245b2a82ae6ca975dc67a9.exe	101
PID 2216 wrote to memory of 3916	2216	Unicorn-57738.exe	106
PID 2216 wrote to memory of 3916	2216	Unicorn-57738.exe	106
PID 2216 wrote to memory of 3916	2216	Unicorn-57738.exe	106
PID 2784 wrote to memory of 3004	2784	Unicorn-49788.exe	107
PID 2784 wrote to memory of 3004	2784	Unicorn-49788.exe	107
PID 2784 wrote to memory of 3004	2784	Unicorn-49788.exe	107
PID 2956 wrote to memory of 3292	2956	Unicorn-46041.exe	108
PID 2956 wrote to memory of 3292	2956	Unicorn-46041.exe	108
PID 2956 wrote to memory of 3292	2956	Unicorn-46041.exe	108
PID 4624 wrote to memory of 2836	4624	Unicorn-28216.exe	109
PID 4624 wrote to memory of 2836	4624	Unicorn-28216.exe	109
PID 4624 wrote to memory of 2836	4624	Unicorn-28216.exe	109
PID 1356 wrote to memory of 3912	1356	Unicorn-29049.exe	111
PID 1356 wrote to memory of 3912	1356	Unicorn-29049.exe	111
PID 1356 wrote to memory of 3912	1356	Unicorn-29049.exe	111
PID 3236 wrote to memory of 2916	3236	Unicorn-7364.exe	112
PID 3236 wrote to memory of 2916	3236	Unicorn-7364.exe	112
PID 3236 wrote to memory of 2916	3236	Unicorn-7364.exe	112
PID 2380 wrote to memory of 3396	2380	0f7a34fad22dcead9aec5f6c4344ba2a2b7139bd80245b2a82ae6ca975dc67a9.exe	113
PID 2380 wrote to memory of 3396	2380	0f7a34fad22dcead9aec5f6c4344ba2a2b7139bd80245b2a82ae6ca975dc67a9.exe	113
PID 2380 wrote to memory of 3396	2380	0f7a34fad22dcead9aec5f6c4344ba2a2b7139bd80245b2a82ae6ca975dc67a9.exe	113
PID 4624 wrote to memory of 4376	4624	Unicorn-28216.exe	117
PID 4624 wrote to memory of 4376	4624	Unicorn-28216.exe	117
PID 4624 wrote to memory of 4376	4624	Unicorn-28216.exe	117
PID 3916 wrote to memory of 3948	3916	Unicorn-19804.exe	118
PID 3916 wrote to memory of 3948	3916	Unicorn-19804.exe	118
PID 3916 wrote to memory of 3948	3916	Unicorn-19804.exe	118
PID 2216 wrote to memory of 4056	2216	Unicorn-57738.exe	119
PID 2216 wrote to memory of 4056	2216	Unicorn-57738.exe	119
PID 2216 wrote to memory of 4056	2216	Unicorn-57738.exe	119
PID 3004 wrote to memory of 1932	3004	Unicorn-8106.exe	120
PID 3004 wrote to memory of 1932	3004	Unicorn-8106.exe	120
PID 3004 wrote to memory of 1932	3004	Unicorn-8106.exe	120
PID 2784 wrote to memory of 1924	2784	Unicorn-49788.exe	121
PID 2784 wrote to memory of 1924	2784	Unicorn-49788.exe	121
PID 2784 wrote to memory of 1924	2784	Unicorn-49788.exe	121
PID 3292 wrote to memory of 3836	3292	Unicorn-36140.exe	122
PID 3292 wrote to memory of 3836	3292	Unicorn-36140.exe	122
PID 3292 wrote to memory of 3836	3292	Unicorn-36140.exe	122
PID 2916 wrote to memory of 1308	2916	Unicorn-28526.exe	123
PID 2916 wrote to memory of 1308	2916	Unicorn-28526.exe	123
PID 2916 wrote to memory of 1308	2916	Unicorn-28526.exe	123
PID 2956 wrote to memory of 4088	2956	Unicorn-46041.exe	124

C:\Users\Admin\AppData\Local\Temp\0f7a34fad22dcead9aec5f6c4344ba2a2b7139bd80245b2a82ae6ca975dc67a9.exe
"C:\Users\Admin\AppData\Local\Temp\0f7a34fad22dcead9aec5f6c4344ba2a2b7139bd80245b2a82ae6ca975dc67a9.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28216.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28216.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49788.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49788.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57738.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19804.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7105.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3948
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 720
        7⤵
        Program crash
        
        PID:320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3166.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44604.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38740.exe
        8⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5377.exe
        9⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        10⤵
        
        PID:13364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40356.exe
        10⤵
        
        PID:17000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28103.exe
        10⤵
        
        PID:18808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20304.exe
        9⤵
        
        PID:11128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        9⤵
        
        PID:15104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47975.exe
        9⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24991.exe
        8⤵
        
        PID:8492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59190.exe
        8⤵
        
        PID:11796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25820.exe
        8⤵
        
        PID:16188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52668.exe
        8⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-400.exe
        7⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27552.exe
        8⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        8⤵
        
        PID:10656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        8⤵
        
        PID:15252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21332.exe
        8⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27067.exe
        7⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15400.exe
        7⤵
        
        PID:9448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34564.exe
        7⤵
        
        PID:16044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30110.exe
        7⤵
        
        PID:18548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42558.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22404.exe
        7⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12777.exe
        8⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38354.exe
        9⤵
        
        PID:13916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50855.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:16600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40932.exe
        9⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        8⤵
        
        PID:10372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        8⤵
        
        PID:15244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
        8⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48143.exe
        7⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56781.exe
        8⤵
        
        PID:14124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22763.exe
        8⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14259.exe
        8⤵
        
        PID:18672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9535.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        7⤵
        
        PID:14868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35225.exe
        7⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34391.exe
        6⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18568.exe
        7⤵
        
        PID:8460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50376.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        7⤵
        
        PID:14844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35225.exe
        7⤵
        
        PID:17880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59078.exe
        6⤵
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29094.exe
        6⤵
        
        PID:9568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49938.exe
        6⤵
        
        PID:14796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18309.exe
        6⤵
        
        PID:5644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27089.exe
        6⤵
        
        PID:18736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60945.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20894.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42466.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8013.exe
        8⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20370.exe
        9⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62131.exe
        9⤵
        
        PID:10892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61362.exe
        9⤵
        
        PID:13400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15172.exe
        9⤵
        
        PID:17436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63030.exe
        8⤵
        
        PID:8484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26102.exe
        9⤵
        
        PID:13780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38218.exe
        9⤵
        
        PID:17384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56241.exe
        8⤵
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34564.exe
        8⤵
        
        PID:15560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3467.exe
        8⤵
        
        PID:7180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8568.exe
        7⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4033.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55307.exe
        8⤵
        
        PID:10184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24003.exe
        8⤵
        
        PID:15468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37669.exe
        8⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61878.exe
        7⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54295.exe
        7⤵
        
        PID:11292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34564.exe
        7⤵
        
        PID:16028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30110.exe
        7⤵
        
        PID:3332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30768.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5875.exe
        7⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27168.exe
        8⤵
        
        PID:8028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        8⤵
        
        PID:10620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        8⤵
        
        PID:15300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56143.exe
        8⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65247.exe
        7⤵
        
        PID:7356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21787.exe
        7⤵
        
        PID:9384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        7⤵
        
        PID:14900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12667.exe
        7⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50892.exe
        6⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56934.exe
        7⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48084.exe
        8⤵
        
        PID:12152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43672.exe
        8⤵
        
        PID:16372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32379.exe
        8⤵
        
        PID:18568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64295.exe
        7⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51824.exe
        7⤵
        
        PID:14608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33777.exe
        7⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14878.exe
        7⤵
        
        PID:16112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51599.exe
        6⤵
        
        PID:7912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6735.exe
        6⤵
        
        PID:10512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32872.exe
        6⤵
        
        PID:15076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39840.exe
        6⤵
        
        PID:5688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35184.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32160.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65190.exe
        7⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19768.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27550.exe
        9⤵
        
        PID:17104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20304.exe
        8⤵
        
        PID:11072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        8⤵
        
        PID:15192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
        8⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20130.exe
        7⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35334.exe
        8⤵
        
        PID:16592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9535.exe
        7⤵
        
        PID:10668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51100.exe
        7⤵
        
        PID:15944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29380.exe
        7⤵
        
        PID:18516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57577.exe
        6⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-525.exe
        7⤵
        
        PID:8064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28624.exe
        8⤵
        
        PID:12348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59407.exe
        8⤵
        
        PID:17220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8970.exe
        8⤵
        
        PID:18896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        7⤵
        
        PID:10628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44040.exe
        7⤵
        
        PID:15180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
        7⤵
        
        PID:5884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40280.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32324.exe
        7⤵
        
        PID:13548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38218.exe
        7⤵
        
        PID:17392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15400.exe
        6⤵
        
        PID:10468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49408.exe
        6⤵
        
        PID:14548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23036.exe
        6⤵
        
        PID:8660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35979.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63244.exe
        6⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55756.exe
        7⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42054.exe
        8⤵
        
        PID:13316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9630.exe
        8⤵
        
        PID:17116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10397.exe
        8⤵
        
        PID:18932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        7⤵
        
        PID:10608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        7⤵
        
        PID:15260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21332.exe
        7⤵
        
        PID:5900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22268.exe
        6⤵
        
        PID:6200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9535.exe
        6⤵
        
        PID:10604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        6⤵
        
        PID:14884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35225.exe
        6⤵
        
        PID:5388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48092.exe
        5⤵
        
        PID:4312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
        6⤵
        
        PID:6532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        6⤵
        
        PID:10640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        6⤵
        
        PID:15208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
        6⤵
        
        PID:17924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41172.exe
        5⤵
        
        PID:7440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59158.exe
        6⤵
        
        PID:12808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28104.exe
        6⤵
        
        PID:17088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63460.exe
        6⤵
        
        PID:7124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7265.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28407.exe
        5⤵
        
        PID:15044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55952.exe
        5⤵
        
        PID:5372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8106.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31610.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54142.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38766.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15990.exe
        8⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58304.exe
        9⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42630.exe
        10⤵
        
        PID:13404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40356.exe
        10⤵
        
        PID:17024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34325.exe
        10⤵
        
        PID:18860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21316.exe
        9⤵
        
        PID:10156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24029.exe
        9⤵
        
        PID:13460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50969.exe
        9⤵
        
        PID:18268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39590.exe
        8⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51286.exe
        9⤵
        
        PID:14360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4310.exe
        9⤵
        
        PID:18584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9535.exe
        8⤵
        
        PID:10788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11010.exe
        8⤵
        
        PID:15092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20835.exe
        8⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24712.exe
        7⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7323.exe
        8⤵
        
        PID:7528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        9⤵
        
        PID:17632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38213.exe
        9⤵
        
        PID:18964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        8⤵
        
        PID:10224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        8⤵
        
        PID:15112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21332.exe
        8⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32495.exe
        7⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15400.exe
        7⤵
        
        PID:10568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49408.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61931.exe
        7⤵
        
        PID:7220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53711.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1599.exe
        7⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5377.exe
        8⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20304.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        8⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11816.exe
        8⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27120.exe
        7⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34039.exe
        7⤵
        
        PID:11224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        7⤵
        
        PID:14932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39310.exe
        7⤵
        
        PID:5496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47348.exe
        6⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-525.exe
        7⤵
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17934.exe
        8⤵
        
        PID:13676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38218.exe
        8⤵
        
        PID:16340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        7⤵
        
        PID:9292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        7⤵
        
        PID:15236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21332.exe
        7⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2127.exe
        6⤵
        
        PID:9176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54331.exe
        6⤵
        
        PID:12156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42346.exe
        6⤵
        
        PID:15952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24915.exe
        6⤵
        
        PID:18488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42444.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52964.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6415.exe
        7⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30676.exe
        8⤵
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28598.exe
        9⤵
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48665.exe
        9⤵
        
        PID:17652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48405.exe
        9⤵
        
        PID:9940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15068.exe
        8⤵
        
        PID:10920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61362.exe
        8⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53683.exe
        8⤵
        
        PID:18256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46773.exe
        7⤵
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9535.exe
        7⤵
        
        PID:9424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        7⤵
        
        PID:14924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31141.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13000.exe
        6⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-525.exe
        7⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        7⤵
        
        PID:10980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60376.exe
        7⤵
        
        PID:14556
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14556 -s 464
        8⤵
        Program crash
        
        PID:17940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
        7⤵
        
        PID:18088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63222.exe
        6⤵
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51406.exe
        6⤵
        
        PID:12412
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12412 -s 436
        7⤵
        Program crash
        
        PID:14332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38072.exe
        6⤵
        
        PID:14512
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14512 -s 436
        7⤵
        Program crash
        
        PID:19340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38278.exe
        6⤵
        
        PID:18468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14737.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53239.exe
        6⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3849.exe
        7⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1576.exe
        7⤵
        
        PID:12372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52557.exe
        7⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11489.exe
        7⤵
        
        PID:18740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43438.exe
        6⤵
        
        PID:8676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7616.exe
        6⤵
        
        PID:11876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47270.exe
        6⤵
        
        PID:14684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19144.exe
        6⤵
        
        PID:9120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34739.exe
        5⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12777.exe
        6⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36180.exe
        7⤵
        
        PID:17784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        6⤵
        
        PID:10544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17397.exe
        6⤵
        
        PID:15132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60227.exe
        6⤵
        
        PID:1804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29695.exe
        5⤵
        
        PID:6784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55737.exe
        5⤵
        
        PID:10872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49938.exe
        5⤵
        
        PID:14892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18309.exe
        5⤵
        
        PID:5808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64374.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4941.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8423.exe
        6⤵
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51340.exe
        7⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10400.exe
        8⤵
        
        PID:8432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50376.exe
        8⤵
        
        PID:7852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        8⤵
        
        PID:14832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39310.exe
        8⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20901.exe
        8⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57655.exe
        7⤵
        
        PID:7284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        8⤵
        
        PID:13380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40356.exe
        8⤵
        
        PID:17016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15851.exe
        8⤵
        
        PID:18708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60071.exe
        7⤵
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19797.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60107.exe
        7⤵
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2040.exe
        7⤵
        
        PID:5508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37504.exe
        6⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-525.exe
        7⤵
        
        PID:8080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        7⤵
        
        PID:8928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        7⤵
        
        PID:15268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
        7⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5853.exe
        6⤵
        
        PID:8216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60528.exe
        7⤵
        
        PID:12892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15276.exe
        7⤵
        
        PID:16856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34325.exe
        7⤵
        
        PID:18768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51406.exe
        6⤵
        
        PID:12304
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12304 -s 472
        7⤵
        Program crash
        
        PID:14280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38072.exe
        6⤵
        
        PID:14260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43789.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28782.exe
        6⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5377.exe
        7⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20304.exe
        7⤵
        
        PID:11200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        7⤵
        
        PID:15120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47975.exe
        7⤵
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49487.exe
        6⤵
        
        PID:7456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9535.exe
        6⤵
        
        PID:10632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        6⤵
        
        PID:14860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35225.exe
        6⤵
        
        PID:5392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12345.exe
        5⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43504.exe
        6⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50798.exe
        7⤵
        
        PID:13424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40356.exe
        7⤵
        
        PID:16992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34694.exe
        6⤵
        
        PID:9944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        6⤵
        
        PID:15292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47975.exe
        6⤵
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11718.exe
        5⤵
        
        PID:8208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59158.exe
        6⤵
        
        PID:12772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28104.exe
        6⤵
        
        PID:17052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34870.exe
        5⤵
        
        PID:11028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55138.exe
        5⤵
        
        PID:14636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24915.exe
        5⤵
        
        PID:18524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47655.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31366.exe
        5⤵
        
        PID:228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63976.exe
        6⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47588.exe
        7⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5692 -s 652
        7⤵
        Program crash
        
        PID:10972
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 636
        6⤵
        Program crash
        
        PID:7108
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 724
        5⤵
        Program crash
        
        PID:5788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12129.exe
      4⤵
      PID:2984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63976.exe
        5⤵
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29882.exe
        6⤵
        
        PID:7656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42054.exe
        7⤵
        
        PID:12972
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7656 -s 656
        7⤵
        Program crash
        
        PID:15848
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6100 -s 724
        6⤵
        Program crash
        
        PID:11024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57655.exe
        5⤵
        
        PID:8140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9535.exe
        5⤵
        
        PID:9548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        5⤵
        
        PID:14876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12667.exe
        5⤵
        
        PID:6032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5646.exe
      4⤵
      PID:2120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47814.exe
        5⤵
        
        PID:8696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62645.exe
        5⤵
        
        PID:11508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44616.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54581.exe
        5⤵
        
        PID:7024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3583.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40965.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23072.exe
      4⤵
      PID:15036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60153.exe
      4⤵
      PID:5636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46041.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46041.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36140.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21304.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33530.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29804.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7567.exe
        8⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47814.exe
        9⤵
        
        PID:8356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9360.exe
        9⤵
        
        PID:11452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45156.exe
        9⤵
        
        PID:16208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29702.exe
        8⤵
        
        PID:8712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1751.exe
        8⤵
        
        PID:11896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45629.exe
        8⤵
        
        PID:15012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2079.exe
        8⤵
        
        PID:9112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54391.exe
        7⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3849.exe
        8⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1576.exe
        8⤵
        
        PID:12384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22597.exe
        8⤵
        
        PID:16380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54581.exe
        8⤵
        
        PID:18532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38368.exe
        7⤵
        
        PID:9412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6594.exe
        7⤵
        
        PID:12732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5983.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33464.exe
        7⤵
        
        PID:17740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61085.exe
        6⤵
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63182.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51898.exe
        8⤵
        
        PID:8344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9360.exe
        8⤵
        
        PID:11892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45348.exe
        8⤵
        
        PID:16060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54581.exe
        8⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63640.exe
        7⤵
        
        PID:9432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5224.exe
        7⤵
        
        PID:12840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5983.exe
        7⤵
        
        PID:12928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6481.exe
        6⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5260 -s 632
        7⤵
        Program crash
        
        PID:10904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9998.exe
        6⤵
        
        PID:9580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4727.exe
        6⤵
        
        PID:12952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24258.exe
        6⤵
        
        PID:1820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21832.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8615.exe
        6⤵
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21190.exe
        7⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43730.exe
        8⤵
        
        PID:8276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29086.exe
        9⤵
        
        PID:17380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60772.exe
        9⤵
        
        PID:10236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38140.exe
        8⤵
        
        PID:12212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44616.exe
        8⤵
        
        PID:16084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54581.exe
        8⤵
        
        PID:18436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21534.exe
        7⤵
        
        PID:8648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34615.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23263.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24919.exe
        7⤵
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37094.exe
        6⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12017.exe
        7⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32302.exe
        7⤵
        
        PID:12352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57408.exe
        7⤵
        
        PID:14532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19770.exe
        7⤵
        
        PID:6000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1035.exe
        6⤵
        
        PID:8808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13646.exe
        6⤵
        
        PID:12188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51354.exe
        6⤵
        
        PID:14412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-216.exe
        6⤵
        
        PID:18040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9283.exe
        5⤵
        
        PID:2176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44708.exe
        6⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43730.exe
        7⤵
        
        PID:8320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9360.exe
        7⤵
        
        PID:11828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45348.exe
        7⤵
        
        PID:16020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60803.exe
        7⤵
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48753.exe
        6⤵
        
        PID:8784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7781.exe
        6⤵
        
        PID:12196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60019.exe
        6⤵
        
        PID:1768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64902.exe
        6⤵
        
        PID:18420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16430.exe
        5⤵
        
        PID:6468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25718.exe
        6⤵
        
        PID:13004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36143.exe
        5⤵
        
        PID:9552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53729.exe
        5⤵
        
        PID:12936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41324.exe
        5⤵
        
        PID:4616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5522.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31392.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27666.exe
        6⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43146.exe
        7⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34768.exe
        8⤵
        
        PID:9760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61275.exe
        8⤵
        
        PID:13308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14813.exe
        8⤵
        
        PID:16440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47496.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25401.exe
        7⤵
        
        PID:14744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12667.exe
        7⤵
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14126.exe
        6⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1903.exe
        7⤵
        
        PID:9948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34414.exe
        7⤵
        
        PID:11908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44336.exe
        7⤵
        
        PID:17984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53718.exe
        6⤵
        
        PID:10524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59059.exe
        6⤵
        
        PID:6588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13715.exe
        6⤵
        
        PID:18148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36889.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46695.exe
        5⤵
        
        PID:5196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44708.exe
        6⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-525.exe
        7⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        7⤵
        
        PID:11040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44232.exe
        7⤵
        
        PID:15668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54773.exe
        7⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8454.exe
        6⤵
        
        PID:8300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64766.exe
        6⤵
        
        PID:2624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31291.exe
        6⤵
        
        PID:12492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17659.exe
        6⤵
        
        PID:15588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62053.exe
        6⤵
        
        PID:18744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31177.exe
        5⤵
        
        PID:7032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21556.exe
        6⤵
        
        PID:8316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1576.exe
        6⤵
        
        PID:11284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52557.exe
        6⤵
        
        PID:16896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54596.exe
        6⤵
        
        PID:18684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44233.exe
        5⤵
        
        PID:9392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63466.exe
        5⤵
        
        PID:12668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35934.exe
        5⤵
        
        PID:15796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11635.exe
        5⤵
        
        PID:18420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33429.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54116.exe
        5⤵
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18066.exe
        6⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7933.exe
        7⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6380 -s 664
        7⤵
        Program crash
        
        PID:11904
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5404 -s 708
        6⤵
        Program crash
        
        PID:7996
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 636
        5⤵
        Program crash
        
        PID:6752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64733.exe
      4⤵
      PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16696.exe
        5⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34039.exe
        6⤵
        
        PID:11120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23263.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51562.exe
        6⤵
        
        PID:17712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55935.exe
        5⤵
        
        PID:9820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7911.exe
        5⤵
        
        PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29231.exe
        5⤵
        
        PID:17148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12809.exe
      4⤵
      PID:7084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19174.exe
        5⤵
        
        PID:11084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27014.exe
        5⤵
        
        PID:14416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44310.exe
        5⤵
        
        PID:3372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13962.exe
      4⤵
      PID:9980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45880.exe
      4⤵
      PID:11904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20535.exe
      4⤵
      PID:17972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7451.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7451.exe
    3⤵
    - Executes dropped EXE
    PID:2836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41075.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41075.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36270.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44220.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46524.exe
        6⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37692.exe
        7⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33886.exe
        8⤵
        
        PID:12848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
        8⤵
        
        PID:16832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19935.exe
        8⤵
        
        PID:19092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41544.exe
        7⤵
        
        PID:9644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32827.exe
        7⤵
        
        PID:13624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58474.exe
        7⤵
        
        PID:17360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34175.exe
        7⤵
        
        PID:18504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57873.exe
        6⤵
        
        PID:7676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39110.exe
        6⤵
        
        PID:10572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59059.exe
        6⤵
        
        PID:6380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12153.exe
        6⤵
        
        PID:18228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8184.exe
        5⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54028.exe
        6⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64612.exe
        7⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
        7⤵
        
        PID:16816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15851.exe
        7⤵
        
        PID:18692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41544.exe
        6⤵
        
        PID:9636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32827.exe
        6⤵
        
        PID:12648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58474.exe
        6⤵
        
        PID:808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49050.exe
        5⤵
        
        PID:7768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44576.exe
        6⤵
        
        PID:13756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38218.exe
        6⤵
        
        PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26501.exe
        5⤵
        
        PID:10844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41616.exe
        5⤵
        
        PID:15324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17281.exe
        5⤵
        
        PID:5284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5880.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60722.exe
        5⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48984.exe
        6⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53242.exe
        7⤵
        
        PID:9848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41238.exe
        7⤵
        
        PID:12344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8975.exe
        7⤵
        
        PID:17224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12956.exe
        6⤵
        
        PID:9504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32827.exe
        6⤵
        
        PID:12984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58474.exe
        6⤵
        
        PID:3088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55172.exe
        6⤵
        
        PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46799.exe
        5⤵
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13610.exe
        6⤵
        
        PID:14256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57574.exe
        6⤵
        
        PID:17500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8613.exe
        6⤵
        
        PID:1208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45551.exe
        5⤵
        
        PID:10996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58562.exe
        5⤵
        
        PID:224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28482.exe
        5⤵
        
        PID:18216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48370.exe
      4⤵
      PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39420.exe
        5⤵
        
        PID:8152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        5⤵
        
        PID:10808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        5⤵
        
        PID:15284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21332.exe
        5⤵
        
        PID:17916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2206.exe
      4⤵
      PID:6804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18987.exe
      4⤵
      PID:8440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51630.exe
      4⤵
      PID:16148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55641.exe
      4⤵
      PID:6140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36275.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36275.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25746.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7437.exe
        5⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15133.exe
        6⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34039.exe
        7⤵
        
        PID:11152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        7⤵
        
        PID:14784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12667.exe
        7⤵
        
        PID:5140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41544.exe
        6⤵
        
        PID:9628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7527.exe
        6⤵
        
        PID:12996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49459.exe
        6⤵
        
        PID:4956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61957.exe
        5⤵
        
        PID:7708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58966.exe
        6⤵
        
        PID:13476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42302.exe
        6⤵
        
        PID:16476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20635.exe
        5⤵
        
        PID:10612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59059.exe
        5⤵
        
        PID:12456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12537.exe
        5⤵
        
        PID:17584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34634.exe
      4⤵
      PID:5936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48984.exe
        5⤵
        
        PID:6936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46781.exe
        6⤵
        
        PID:10340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64870.exe
        6⤵
        
        PID:13792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49407.exe
        6⤵
        
        PID:18412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12956.exe
        5⤵
        
        PID:9496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32827.exe
        5⤵
        
        PID:12628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58474.exe
        5⤵
        
        PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40781.exe
        5⤵
        
        PID:8656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33891.exe
      4⤵
      PID:6624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32516.exe
        5⤵
        
        PID:13220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9630.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26719.exe
      4⤵
      PID:10100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24737.exe
      4⤵
      PID:12204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5566.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35090.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35090.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13851.exe
      4⤵
      PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32264.exe
        5⤵
        
        PID:6540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11057.exe
        6⤵
        
        PID:8248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59931.exe
        6⤵
        
        PID:12144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44616.exe
        6⤵
        
        PID:15936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54581.exe
        6⤵
        
        PID:15868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7528.exe
        5⤵
        
        PID:8268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51876.exe
        5⤵
        
        PID:12248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50481.exe
        5⤵
        
        PID:16076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52138.exe
        5⤵
        
        PID:3936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60613.exe
      4⤵
      PID:1692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33886.exe
        5⤵
        
        PID:12880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15276.exe
        5⤵
        
        PID:16884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63448.exe
      4⤵
      PID:9720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15338.exe
      4⤵
      PID:12472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44686.exe
      4⤵
      PID:16844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46292.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46292.exe
    3⤵
    PID:5748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51314.exe
      4⤵
      PID:6728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8125.exe
        5⤵
        
        PID:9784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61275.exe
        5⤵
        
        PID:13264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14813.exe
        5⤵
        
        PID:16428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48945.exe
      4⤵
      PID:9188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44654.exe
        5⤵
        
        PID:812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56688.exe
        5⤵
        
        PID:9184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20957.exe
      4⤵
      PID:5068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51021.exe
      4⤵
      PID:16172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25495.exe
      4⤵
      PID:7188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22535.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22535.exe
    3⤵
    PID:7008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34768.exe
      4⤵
      PID:9748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61275.exe
      4⤵
      PID:13300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14813.exe
      4⤵
      PID:16448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58665.exe
      4⤵
      PID:17660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43056.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43056.exe
    3⤵
    PID:9956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23214.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23214.exe
    3⤵
    PID:6484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14222.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14222.exe
    3⤵
    PID:17996
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7364.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7364.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-369.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-369.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4312
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 720
      4⤵
      Program crash
      PID:3304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28526.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28526.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60198.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53950.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17936.exe
        6⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48984.exe
        7⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22080.exe
        8⤵
        
        PID:10232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55193.exe
        8⤵
        
        PID:15632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44824.exe
        8⤵
        
        PID:17144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12956.exe
        7⤵
        
        PID:9512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32827.exe
        7⤵
        
        PID:12584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58474.exe
        7⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55172.exe
        7⤵
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24240.exe
        6⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23964.exe
        7⤵
        
        PID:12784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13802.exe
        7⤵
        
        PID:13888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59712.exe
        7⤵
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59376.exe
        7⤵
        
        PID:18528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20853.exe
        6⤵
        
        PID:10708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6926.exe
        6⤵
        
        PID:14772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39310.exe
        6⤵
        
        PID:17852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61469.exe
        5⤵
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15133.exe
        6⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4041.exe
        7⤵
        
        PID:9704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61275.exe
        7⤵
        
        PID:12488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53708.exe
        7⤵
        
        PID:16420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51659.exe
        6⤵
        
        PID:9972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63526.exe
        6⤵
        
        PID:14228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4918.exe
        6⤵
        
        PID:2076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46300.exe
        6⤵
        
        PID:17640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10155.exe
        5⤵
        
        PID:7716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28546.exe
        6⤵
        
        PID:9884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47269.exe
        6⤵
        
        PID:13500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51954.exe
        6⤵
        
        PID:14284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61721.exe
        5⤵
        
        PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2947.exe
        5⤵
        
        PID:1788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51835.exe
        5⤵
        
        PID:17928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20514.exe
        5⤵
        
        PID:18932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42252.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23582.exe
        5⤵
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17490.exe
        6⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-525.exe
        7⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        7⤵
        
        PID:10992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34117.exe
        7⤵
        
        PID:15596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15878.exe
        7⤵
        
        PID:628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19984.exe
        7⤵
        
        PID:18572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12538.exe
        6⤵
        
        PID:8332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60071.exe
        6⤵
        
        PID:12316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54608.exe
        6⤵
        
        PID:16344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29380.exe
        6⤵
        
        PID:18448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37862.exe
        5⤵
        
        PID:7148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31862.exe
        6⤵
        
        PID:3532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11882.exe
        6⤵
        
        PID:11816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22597.exe
        6⤵
        
        PID:15344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34283.exe
        5⤵
        
        PID:9312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6594.exe
        5⤵
        
        PID:12692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5983.exe
        5⤵
        
        PID:16352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49800.exe
        5⤵
        
        PID:18584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41956.exe
      4⤵
      PID:5252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16312.exe
        5⤵
        
        PID:6816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65494.exe
        6⤵
        
        PID:9672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61275.exe
        6⤵
        
        PID:13272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14813.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40191.exe
        6⤵
        
        PID:18940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12572.exe
        5⤵
        
        PID:7396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15311.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63273.exe
        5⤵
        
        PID:14524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-862.exe
      4⤵
      PID:6664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55868.exe
        5⤵
        
        PID:11964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31612.exe
        5⤵
        
        PID:15992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48716.exe
        5⤵
        
        PID:18500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20350.exe
      4⤵
      PID:11008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59092.exe
      4⤵
      PID:1372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23441.exe
      4⤵
      PID:18196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-783.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-783.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43644.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27474.exe
        5⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10281.exe
        6⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        7⤵
        
        PID:13352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40356.exe
        7⤵
        
        PID:17008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20548.exe
        6⤵
        
        PID:9324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-729.exe
        6⤵
        
        PID:12640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43237.exe
        6⤵
        
        PID:16580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23933.exe
        6⤵
        
        PID:19232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53021.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36216.exe
        6⤵
        
        PID:12868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16349.exe
        6⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53154.exe
        6⤵
        
        PID:8892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47689.exe
        5⤵
        
        PID:9876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1769.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16936.exe
        5⤵
        
        PID:18844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41048.exe
      4⤵
      PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10281.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57622.exe
        6⤵
        
        PID:9224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51109.exe
        6⤵
        
        PID:15548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40740.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20548.exe
        5⤵
        
        PID:9348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-729.exe
        5⤵
        
        PID:13108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43237.exe
        5⤵
        
        PID:16604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1219.exe
      4⤵
      PID:1348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60912.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38218.exe
        5⤵
        
        PID:17400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59583.exe
      4⤵
      PID:9996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45350.exe
      4⤵
      PID:12920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-112.exe
      4⤵
      PID:17828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24905.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24905.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27474.exe
      4⤵
      PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48600.exe
        5⤵
        
        PID:6600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24218.exe
        6⤵
        
        PID:11980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36334.exe
        6⤵
        
        PID:14672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50278.exe
        6⤵
        
        PID:17952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38254.exe
        5⤵
        
        PID:8224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51876.exe
        5⤵
        
        PID:12256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50481.exe
        5⤵
        
        PID:15976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11105.exe
        5⤵
        
        PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25802.exe
      4⤵
      PID:6964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54306.exe
        5⤵
        
        PID:12992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28104.exe
        5⤵
        
        PID:17072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28637.exe
      4⤵
      PID:9736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15338.exe
      4⤵
      PID:11288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12013.exe
      4⤵
      PID:16396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19074.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19074.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:18784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56068.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56068.exe
    3⤵
    PID:5620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17874.exe
      4⤵
      PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42246.exe
        5⤵
        
        PID:13224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1078.exe
        5⤵
        
        PID:16168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2007.exe
        5⤵
        
        PID:18012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32608.exe
      4⤵
      PID:7644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61990.exe
      4⤵
      PID:12116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51021.exe
      4⤵
      PID:16216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-799.exe
      4⤵
      PID:18952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55013.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55013.exe
    3⤵
    PID:7004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22708.exe
      4⤵
      PID:5488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50725.exe
      4⤵
      PID:15164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50278.exe
      4⤵
      PID:17956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57094.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57094.exe
    3⤵
    PID:9680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51209.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51209.exe
    3⤵
    PID:13248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51214.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51214.exe
    3⤵
    PID:16408
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29049.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29049.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17666.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17666.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6913.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24930.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53239.exe
        6⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4041.exe
        7⤵
        
        PID:9712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61275.exe
        7⤵
        
        PID:13256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14813.exe
        7⤵
        
        PID:16456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48359.exe
        7⤵
        
        PID:18720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43438.exe
        6⤵
        
        PID:8684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7616.exe
        6⤵
        
        PID:11868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47270.exe
        6⤵
        
        PID:12336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30942.exe
        6⤵
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28683.exe
        6⤵
        
        PID:9132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55516.exe
        5⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39420.exe
        6⤵
        
        PID:8144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        6⤵
        
        PID:10824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        6⤵
        
        PID:14560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18614.exe
        6⤵
        
        PID:9136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38361.exe
        5⤵
        
        PID:8252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61966.exe
        5⤵
        
        PID:11116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51630.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4495.exe
        5⤵
        
        PID:5184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31946.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41864.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48984.exe
        6⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21940.exe
        7⤵
        
        PID:9460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51161.exe
        7⤵
        
        PID:12832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8783.exe
        7⤵
        
        PID:16316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40191.exe
        7⤵
        
        PID:18920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20548.exe
        6⤵
        
        PID:9304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-729.exe
        6⤵
        
        PID:12724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61135.exe
        6⤵
        
        PID:14096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11105.exe
        6⤵
        
        PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46799.exe
        5⤵
        
        PID:6596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20378.exe
        6⤵
        
        PID:9908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22572.exe
        6⤵
        
        PID:13928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64590.exe
        6⤵
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54965.exe
        6⤵
        
        PID:18068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51406.exe
        5⤵
        
        PID:12332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3262.exe
        5⤵
        
        PID:15308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46446.exe
        5⤵
        
        PID:5188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29511.exe
      4⤵
      PID:5472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4251.exe
        5⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33886.exe
        6⤵
        
        PID:12856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
        6⤵
        
        PID:16808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58830.exe
        6⤵
        
        PID:18836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51406.exe
        5⤵
        
        PID:12420
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12420 -s 436
        6⤵
        Program crash
        
        PID:12900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38072.exe
        5⤵
        
        PID:2584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46446.exe
        5⤵
        
        PID:18540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5138.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34768.exe
        5⤵
        
        PID:9768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61275.exe
        5⤵
        
        PID:7612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53708.exe
        5⤵
        
        PID:16464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62594.exe
      4⤵
      PID:9964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28814.exe
      4⤵
      PID:12312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17177.exe
      4⤵
      PID:17820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56669.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56669.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6887.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13467.exe
        5⤵
        
        PID:3432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44132.exe
        6⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58504.exe
        7⤵
        
        PID:8284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43979.exe
        7⤵
        
        PID:12080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14429.exe
        7⤵
        
        PID:16320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38245.exe
        7⤵
        
        PID:18576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58879.exe
        7⤵
        
        PID:18472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29702.exe
        6⤵
        
        PID:8720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20072.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38218.exe
        7⤵
        
        PID:15900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1751.exe
        6⤵
        
        PID:11884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55935.exe
        6⤵
        
        PID:14656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16751.exe
        6⤵
        
        PID:18100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60421.exe
        5⤵
        
        PID:7056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52552.exe
        6⤵
        
        PID:13060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29858.exe
        6⤵
        
        PID:16516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38368.exe
        5⤵
        
        PID:9400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2510.exe
        5⤵
        
        PID:12676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17659.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13044.exe
        5⤵
        
        PID:5956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18106.exe
      4⤵
      PID:1388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40240.exe
        5⤵
        
        PID:6204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43730.exe
        6⤵
        
        PID:8232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38140.exe
        6⤵
        
        PID:1656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44616.exe
        6⤵
        
        PID:15960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54581.exe
        6⤵
        
        PID:18508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48753.exe
        5⤵
        
        PID:8776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65150.exe
        5⤵
        
        PID:12132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60019.exe
        5⤵
        
        PID:14396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47478.exe
        5⤵
        
        PID:1928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52393.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15411.exe
        5⤵
        
        PID:12612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28104.exe
        5⤵
        
        PID:17064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18437.exe
      4⤵
      PID:1696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53703.exe
      4⤵
      PID:13588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44972.exe
      4⤵
      PID:18184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47820.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47820.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56254.exe
      4⤵
      PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45092.exe
        5⤵
        
        PID:6876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45816.exe
        6⤵
        
        PID:11060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20984.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47242.exe
        6⤵
        
        PID:18160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20548.exe
        5⤵
        
        PID:9340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-729.exe
        5⤵
        
        PID:12708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61135.exe
        5⤵
        
        PID:15816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11105.exe
        5⤵
        
        PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2427.exe
        5⤵
        
        PID:15908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22294.exe
      4⤵
      PID:6304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64804.exe
        5⤵
        
        PID:13128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46195.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5094.exe
      4⤵
      PID:5912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49408.exe
      4⤵
      PID:15060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61669.exe
      4⤵
      PID:6136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37515.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37515.exe
    3⤵
    PID:5352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10281.exe
      4⤵
      PID:6860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18510.exe
        5⤵
        
        PID:14136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50855.exe
        5⤵
        
        PID:3076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49646.exe
        5⤵
        
        PID:8472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20548.exe
      4⤵
      PID:9356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-729.exe
      4⤵
      PID:12716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26325.exe
      4⤵
      PID:15656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29579.exe
      4⤵
      PID:1360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63148.exe
      4⤵
      PID:18668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63956.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63956.exe
    3⤵
    PID:5760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7243.exe
      4⤵
      PID:12652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28104.exe
      4⤵
      PID:17264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34382.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34382.exe
    3⤵
    PID:10020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61256.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61256.exe
    3⤵
    PID:14212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40789.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40789.exe
    3⤵
    PID:3796
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52211.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52211.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2829.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2829.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24930.exe
      4⤵
      Executes dropped EXE
      PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44578.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19000.exe
        6⤵
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52360.exe
        7⤵
        
        PID:13068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14259.exe
        7⤵
        
        PID:18852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20304.exe
        6⤵
        
        PID:11140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        6⤵
        
        PID:15200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11816.exe
        6⤵
        
        PID:18720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18760.exe
        5⤵
        
        PID:7404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9535.exe
        5⤵
        
        PID:10448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        5⤵
        
        PID:14908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39310.exe
        5⤵
        
        PID:17860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8453.exe
      4⤵
      PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10255.exe
        5⤵
        
        PID:7588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17934.exe
        6⤵
        
        PID:13616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38218.exe
        6⤵
        
        PID:17372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40902.exe
        6⤵
        
        PID:18576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22276.exe
        5⤵
        
        PID:9652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64870.exe
        5⤵
        
        PID:1740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53107.exe
        5⤵
        
        PID:18172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41869.exe
      4⤵
      PID:7052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64612.exe
        5⤵
        
        PID:13124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
        5⤵
        
        PID:16824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15851.exe
        5⤵
        
        PID:18672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45630.exe
      4⤵
      PID:4716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51630.exe
      4⤵
      PID:15972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55641.exe
      4⤵
      PID:2372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47317.exe
      4⤵
      PID:14644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5304.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5304.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48662.exe
      4⤵
      PID:5516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48984.exe
        5⤵
        
        PID:6920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36906.exe
        6⤵
        
        PID:9532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59329.exe
        6⤵
        
        PID:12912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43594.exe
        6⤵
        
        PID:16508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32599.exe
        6⤵
        
        PID:19108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12956.exe
        5⤵
        
        PID:9488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32827.exe
        5⤵
        
        PID:13420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58474.exe
        5⤵
        
        PID:16356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27953.exe
        5⤵
        
        PID:5580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55159.exe
      4⤵
      PID:6364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13610.exe
        5⤵
        
        PID:14200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39100.exe
        5⤵
        
        PID:17536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10175.exe
        5⤵
        
        PID:1644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16193.exe
      4⤵
      PID:8868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47793.exe
      4⤵
      PID:13484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64094.exe
      4⤵
      PID:17960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40394.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40394.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65320.exe
      4⤵
      PID:6956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19174.exe
        5⤵
        
        PID:11076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22930.exe
        5⤵
        
        PID:14400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62976.exe
        5⤵
        
        PID:17700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20548.exe
      4⤵
      PID:9332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-729.exe
      4⤵
      PID:12700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61135.exe
      4⤵
      PID:15844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13051.exe
      4⤵
      PID:18684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35673.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35673.exe
    3⤵
    PID:6300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1789.exe
      4⤵
      PID:13080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28104.exe
      4⤵
      PID:17080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15851.exe
      4⤵
      PID:18700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13969.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13969.exe
    3⤵
    PID:10064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4118.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4118.exe
    3⤵
    PID:13592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51412.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51412.exe
    3⤵
    PID:4960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28148.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28148.exe
    3⤵
    PID:1532
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63520.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63520.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29446.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29446.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14837.exe
      4⤵
      PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31112.exe
        5⤵
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58120.exe
        6⤵
        
        PID:8408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60222.exe
        7⤵
        
        PID:16980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38140.exe
        6⤵
        
        PID:12224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44616.exe
        6⤵
        
        PID:15924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54581.exe
        6⤵
        
        PID:6164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57655.exe
        5⤵
        
        PID:8112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        6⤵
        
        PID:13340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17004.exe
        6⤵
        
        PID:17156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2940.exe
        6⤵
        
        PID:556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9535.exe
        5⤵
        
        PID:10704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
        5⤵
        
        PID:14852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39310.exe
        5⤵
        
        PID:17804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48771.exe
      4⤵
      PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5377.exe
        5⤵
        
        PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20304.exe
        5⤵
        
        PID:11208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        5⤵
        
        PID:15276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40981.exe
        5⤵
        
        PID:18908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34441.exe
      4⤵
      PID:8360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13610.exe
        5⤵
        
        PID:14224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30931.exe
        5⤵
        
        PID:17516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59376.exe
        5⤵
        
        PID:1248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51406.exe
      4⤵
      PID:12324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3262.exe
      4⤵
      PID:15320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11635.exe
      4⤵
      PID:5976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33866.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33866.exe
    3⤵
    PID:1916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3099.exe
      4⤵
      PID:1064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23694.exe
        5⤵
        
        PID:8468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11882.exe
        5⤵
        
        PID:12240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57408.exe
        5⤵
        
        PID:16332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19770.exe
        5⤵
        
        PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15900.exe
        5⤵
        
        PID:18812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20706.exe
      4⤵
      PID:8368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7397.exe
      4⤵
      PID:2196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58073.exe
      4⤵
      PID:14824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39310.exe
      4⤵
      PID:17796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43840.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43840.exe
    3⤵
    PID:5480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5377.exe
      4⤵
      PID:6812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20304.exe
      4⤵
      PID:11220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59765.exe
      4⤵
      PID:15768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29579.exe
      4⤵
      PID:17808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59609.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59609.exe
    3⤵
    PID:8628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38738.exe
      4⤵
      PID:4044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59407.exe
      4⤵
      PID:17180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47865.exe
      4⤵
      PID:8728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19563.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19563.exe
    3⤵
    PID:11468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32872.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32872.exe
    3⤵
    PID:15068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48008.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48008.exe
    3⤵
    PID:5412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5782.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5782.exe
    3⤵
    PID:17924
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16232.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16232.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25720.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25720.exe
    3⤵
    PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9513.exe
      4⤵
      PID:6188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43730.exe
        5⤵
        
        PID:8508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38140.exe
        5⤵
        
        PID:12220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44616.exe
        5⤵
        
        PID:16068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54581.exe
        5⤵
        
        PID:5176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29702.exe
      4⤵
      PID:8704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1751.exe
      4⤵
      PID:11860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55935.exe
      4⤵
      PID:13120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24919.exe
      4⤵
      PID:5660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58283.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58283.exe
    3⤵
    PID:6260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
      4⤵
      PID:13372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5546.exe
      4⤵
      PID:17040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4133.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4133.exe
    3⤵
    PID:9588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13392.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13392.exe
    3⤵
    PID:12944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40794.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40794.exe
    3⤵
    PID:15896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14990.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14990.exe
    3⤵
    PID:18868
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11097.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11097.exe
  2⤵
  PID:5124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63182.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63182.exe
    3⤵
    PID:6308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62588.exe
      4⤵
      PID:8700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11882.exe
      4⤵
      PID:11824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22597.exe
      4⤵
      PID:1192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5120.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5120.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2947.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2947.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:13964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-112.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-112.exe
    3⤵
    PID:17836
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27797.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27797.exe
  2⤵
  PID:7160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44576.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44576.exe
    3⤵
    PID:13768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38218.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38218.exe
    3⤵
    PID:15856
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9232.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9232.exe
  2⤵
  PID:9372
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41330.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41330.exe
  2⤵
  PID:12656
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2598.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2598.exe
  2⤵
  PID:944
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27044.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27044.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4312 -ip 4312
1⤵
PID:4788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3948 -ip 3948
1⤵
PID:3084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4736 -ip 4736
1⤵
PID:5216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4444 -ip 4444
1⤵
PID:6232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 228 -ip 228
1⤵
PID:7976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5404 -ip 5404
1⤵
PID:7404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5260 -ip 5260
1⤵
PID:10224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 6100 -ip 6100
1⤵
PID:10444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5692 -ip 5692
1⤵
PID:10620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 6380 -ip 6380
1⤵
PID:11232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 12304 -ip 12304
1⤵
PID:13796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 12412 -ip 12412
1⤵
PID:13860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 12420 -ip 12420
1⤵
PID:13956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 12324 -ip 12324
1⤵
PID:14160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 12332 -ip 12332
1⤵
PID:14168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 7656 -ip 7656
1⤵
PID:15708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 14556 -ip 14556
1⤵
PID:17852

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:19228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-17666.exe

Filesize
184KB

MD5
17d152324d8b0142320569d9c64bfcc3

SHA1
cf8bc287c6d12ea8bb06237dfff49067a8fd7cc9

SHA256
138579ec051f1e4087663ee0f2ed945b70c35d8e24ac85b5764119c497b6774b

SHA512
23aa3ac0166e1445ccb7cecd139fbfaeb941a4d425aed29263592f8b669eecdb16c7ad7cb332e37f3648d7c96a11cfca49a09d6d2d85750a2be8988177826d82

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19804.exe

Filesize
184KB

MD5
898402f767bfef73f39531c8ae8281da

SHA1
6a9caa8d30e803657e978cc7efdc8f68edeb0fa8

SHA256
74bfc7767adcfc9c85a95c6f1262043f6bf5f39bc23b6e8a819cc9eb48c5f2f5

SHA512
625cda3106c80cf2b0dc55997a6af8cfba8d326d87c72ebad4ec8d19b5afe052ccf3e56db6a5d9c7b4940932dc6a2ae92711fd3ac183f04385bdcfbdf2d2b383

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20894.exe

Filesize
184KB

MD5
5399c29332b23be9eab09128b3633193

SHA1
72d4ffc03f6c1023b9a163a9f2deb41dbe490b0e

SHA256
cdf3187878e1f740908699d7287125fbe4b377122cd3e2b05e9b4f29887592a1

SHA512
5578fa548fb489ee883b1bc15f713b0e556443a099fee9db310774683ee2f39592fd3f29d7938b181c68cedeecde1295e4f8b1f0defa1814b2d4573320736763

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21304.exe

Filesize
184KB

MD5
c2bcc4e57e413069a98185fe75541a9e

SHA1
158a92f9c9bc88dc163c1096a90cd27fdaed837d

SHA256
3d72fe306742b752b638e2f6d3886f7e83062cba262af2c6afc71c5f7424fc9c

SHA512
aa046da1ebc088bf099e594f7ee37c053993a4c5509a81ede4f4df710fd742d6e385324c8bface59e98b9f6129b4a0a4d22efe067c00293aeeaa9c53e04b8c0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28216.exe

Filesize
184KB

MD5
134edb6c15f91c56a3139f630efb1ab2

SHA1
e2b39a80ef1fbb2c8ed59f004c2b194ae4d1b66d

SHA256
4d22bb3f7a242f4039194c207edc9558ce541d59db048a95896838e2bf752b15

SHA512
2a942704352df3c602cd61d285c19b38a593e51b467653efdc23d12e36a2605a95cf0a4959788e7a44cc4b93f4771b31143d8ee501150aaf551d0e27b5129578

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2829.exe

Filesize
184KB

MD5
94b1d01ce358b730d407423e77d8b5ed

SHA1
45a5b2497a1714764125e48a941a3d30a0182e5f

SHA256
4a4f43b30daab967d8167bb2ecea658dd0a060adaf852d2595975a5dad99bb4e

SHA512
251878c2e316864b2b4c28faae36e6ad9b833e4e16d11ba238d7dbf80792ec10d63e01f247fd90dee7a84c18372928128c8894cf9de72caec9b3df55fc08b4f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28526.exe

Filesize
184KB

MD5
3ad5206f2acffef009488f824afad5df

SHA1
82e088ec1d2b7031501563365f21ef1c8d9ac184

SHA256
8e6108179c0b725f4df7ec22e511a720977a91be12f7f22a396cf4863a209088

SHA512
76e5a3130a26bee28e84972d3f299d4e52dced5805c673cf88d7c8007a1bbb2ddd453ec92085e1df40c3c48314206e025d4df90809a219e8833b49f7f0a3aed2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29049.exe

Filesize
184KB

MD5
1f30bb4cfeac00c0365f2fe3dc071180

SHA1
6821f7e7a28c0932c4e9a4414e98e353e0ff373e

SHA256
3dff56c1d14ca529edbb11cd27250da4d077453a05d2ceba34e5c94ddfb8b94b

SHA512
1165bf661499266d4d5265dc67d9808b4252e5bda62971e9d4329fc985e362ea3f710242757a525d21c1074efde8b75136976fb3c97ff0c968bc62433dd5824c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30676.exe

Filesize
184KB

MD5
b840e1546218516955f1382434f3488e

SHA1
02028c769189584bf0ea556dbad030fdcb5dbf35

SHA256
d721ac5ad7e1055abe9d421b845eafe284c8e1f4180657025dc136371dbb5729

SHA512
881986782b6952ada610ef1556d55bff2523d365b99c47a7473e45048d04feeaf3133bd24ade7e0b55ecc677b589569bf93338053cc4cc420c536396762e798e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31610.exe

Filesize
184KB

MD5
12b074fce679250f0687c4a0c264f5c6

SHA1
5a079f04b6462ccd737cb6c9f3b2b66ac0e587eb

SHA256
9d119871baf232b9bc231c93dd1bdea0e52c452bc41ac44961e3e9937101f6e1

SHA512
a364270f776477cb4ed0b360159e678cb39443e7791cd94468fc7ed87409a74320e066f93d7d47fcb7de174dec30c93165587650298a2d089d55adf85099e4d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3166.exe

Filesize
184KB

MD5
500062dc2d06e717e856f039465a74c8

SHA1
3b2a03abc3466a244d402e8509d02de98ba32284

SHA256
15390efd5c83ca0169c5d6967891e2116c5253889bb3e16483953e279a8afa8c

SHA512
84f72cdeb598567cfcbeaa56c8af4c9424cd161acbdc9980930fb52f53cc27910f1eb23c09499d1aaebdc42c01ad3e6ab262a582a91cc987a4d344afc2235e70

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35184.exe

Filesize
184KB

MD5
90004f2cae3d12436416192655f79d84

SHA1
64c1a8d16bc713be96bd31803aa37f668e087abe

SHA256
cf08b6d8c96dfe11da3886b078f349383f50a6c35a3b480c7f2093a38eabce48

SHA512
fc95c31e299399787f4afcb69322006588fdb53345ba0f4fd02f297f17852fb3ed30701bce039530e526d7e586f9079a4de058cebcbdb56d428b8a2d485a79cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36140.exe

Filesize
184KB

MD5
8e2bcf36efc00922d86ea5b3dcbde803

SHA1
c6912a49016fbe2e18f77ead4cbc103dfa5e9e05

SHA256
467ff641de65b78a4cf2ccb4fb8855c453ee26303fe02b646ebbe33f7dd572e7

SHA512
adff4f88bed8b41bdf7c728da5befe8212c19afbdca2b48f2e48df0646704895875d704b3d3087852fa8c0dbfe5a2362751b865cf28e00d432c3b02bb5457690

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36270.exe

Filesize
184KB

MD5
b5a30b9d55ca81ae5b4341a432808e5f

SHA1
e040ac0d3148cd2d0a497dc13e8cab8ecc1cf4f7

SHA256
2844f0204a46c1a118b0e6a3d01cf11570df3cc2ae6fab5156b6cc039c82bdb5

SHA512
f389af84472c7defbb9cf2b43639a0206483b3ed98170e95ff5a03112f26c780a676360260fa0b84a765c41646a3cc43449f384521c0172abfb020f96059b714

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36275.exe

Filesize
184KB

MD5
ce1725d5ebb649d7df57e7b14eaa4716

SHA1
38e87dfc98558eda0d3b269ef22d3c7152fb7e4c

SHA256
1a55fffb102c0d9c3395fd0a3188a6becd7fa2ff04d6150ec9935c2c02bb59f5

SHA512
2dde0c62b4c580d65073f923921a6a5635ec718c9dcf31d27ff30f2746104422b31d9abdbe170879a4046df03764adea6244068fed2468716e6b012fbd681ae0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-369.exe

Filesize
184KB

MD5
cf5110458e442b9e8e9c89191a0eb4e0

SHA1
19eb194477cbd886d94e249394205b0709850ac6

SHA256
6f8a62b09b5f5247502feb31c29b574a83367630e435d8b30a73f3038035ad29

SHA512
25727cbe0cf2af34308214ef228592899cd1ea6dc83b0885fec389269e4de5f782e47196518f598bfc01b6b05c75e0827421a1b6a1e3e4c36f0b4eace711d880

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41075.exe

Filesize
184KB

MD5
3aed350fb0833d81e6684347e9770cd3

SHA1
b58cd46501f82867be26fe0bc2ea1697385e5913

SHA256
66e33e1caa6203ba72b69ec9a4e65ca7731cfc18767aa4b853705a015cbcea1e

SHA512
09e3bcb3b5f57193216f33c9be6b974b7f8eb2d9e5026ce47ca0c6749341ac2c73de8a60f24c4e596adc6b04ad7d30e5a5a917bb91f3ce325205e8d371e7f07f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43504.exe

Filesize
184KB

MD5
6e7d3e22977122e385dfc84ff9219865

SHA1
29179dec70fb1434dffe2150d39d8a6942fd9c80

SHA256
4851876231944f622a87a8029b58edc2b785fd5f04e49fadc7944bff41faed3d

SHA512
771d758433aa390b38d3c0376c1c5e74f55e9ef04f89ace08714b59f069d6e10b922f395902c124aa08735f4cbfa8d7567c787d12adc42ef06eb0226bfa3ccb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46041.exe

Filesize
184KB

MD5
4f70546ca45a8ad0b3d5e7fa8277c6e8

SHA1
9edbcb3003b55c7c08b46b503253f101df0098b3

SHA256
304c47368eb761d23020d25421d12bf66df8cf174ec0df6ac578b748aa7fc7ca

SHA512
dfa36a8edc253460f87afe0d87cee01bb3962ab863cad149365efb9bcb55c25c727a128e1e9bee80616e53be6e384e9fd3472606a8ff70d448c0639f4e56907b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49788.exe

Filesize
184KB

MD5
d737e1098405ab56811f80e5c10296f6

SHA1
18e48285f34f12a05fbc74fe0e033f75009bf44d

SHA256
c628ba8a0e84782421b3bafd3d15487b6bc51a8e1a4f451e6bb3e37c13d28b0a

SHA512
d8204fadac399c0d2c3aaf3381ada697f27317f6fa3f0f3d3b4993f5a05cd73394b4fc0e11c1018e5f8c8ce162deda4505539b8c26756630450313c3f2022b09

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52211.exe

Filesize
184KB

MD5
9ada1c7014c6c3913a8f310d04999465

SHA1
bb4ba3183ad6e7ef297f2072f2ee8b73ba0a88d1

SHA256
dcff991c0bad8dabf4be370de42b44a820d56ce7b587b6acaf5aedc4b4b0e4d3

SHA512
8e792fe3e836f448e5053ebb114b1b45078ef724a5b7daa2ce2f21c1fe30961a99d57df59856b34b751032d0c02a51bfe038bef0e993b465133806296563c05f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5522.exe

Filesize
184KB

MD5
73295c65e9b44f5de3029288d8a186f5

SHA1
fb7621deceaac055c15b74a5238e59570c9f55be

SHA256
cd331d7e3c0734eb0ddf82cdc420e54a502207a65cfffacdd347c10c2a649bef

SHA512
36963f026808e038c38df144b2194fa808f2198f6ae1b2f966e67af99bf240e569cb7100cfaefa43e987e0eef7c7453847728466c8ffa790f86acbcef65d4916

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56143.exe

Filesize
184KB

MD5
8a343a6f11f067041a144cc20954dec3

SHA1
5ca1f36aa3a2abf62be03852e9ebc34feba4808f

SHA256
29e883350e4ca4d7feda08a8cc561196291d6d758bcbccdcd6b3f728263502ca

SHA512
606b4f7d1c943f30e37958a021476a63ae479c088b0521b203c27f8b9d9b89e0e678328e2a5760776fc7c760f553e5639f9e22e33f02650a4eb4c7cd1b89e1af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56669.exe

Filesize
184KB

MD5
a7141186ba8e43c1a637abd75a43dd1d

SHA1
0a602aaf2e7c8afe8bc85b432bf68f537e4996be

SHA256
b4104556d488739fb3b8183e461482c72ac9c0756d961f36d3d27bc219ba3855

SHA512
1b3ed5fb4224edb00811c7d3737a0b01f755759ec703ae28b2f62308cb72e2143b0b4555a73cfcd65f6c0bddbf76b4c71613b6753b12ccbfcd81517d28b28edc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57738.exe

Filesize
184KB

MD5
39b8e892ad4d834842eb0c5aa2109593

SHA1
4c66320ab015ec0aa0246843a1ee4f2a549f719a

SHA256
cabbbf6e78de0cb9207bae4fd31bdf014c8394d35e18c40eff3b50e944f53f19

SHA512
9adabe22e5cfb60519736f7836af5d5ef1a41dccfe043f83b46841919c52dffe725bb36ea0abbc202005ecd1c3ecb5e78fff9639cbabd4851ab51cc1f8adb6e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60198.exe

Filesize
184KB

MD5
2ec71e603b2c356953b50f634141c6e5

SHA1
351e961d73d94370deb36711f125b128d022b67f

SHA256
4a39577975f5762b35d0b2914736f4a32049963951bf0a9f5ef426ca9bddf3bb

SHA512
ec3bacfcdc52f04ffc52c738691a10869cbe82f62846261e6851e10dafa3497a0325c240981eec7b27ccdd062584f8faca19192c2fb554e3d15e4b3bc9bd3caa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60945.exe

Filesize
184KB

MD5
271617a8427454228582185727ee9fdd

SHA1
3e7875976ac15f59ecd46984814612099cdce24b

SHA256
066ba6fac0f7b8a0c0d7c28f03b49994a49edce8117afe0a76d15a1184c2b3f2

SHA512
8dd9536c1666b55f34724227529535e16ee03fa1fb7d03587d1a9d6a561b3ead07722dcfcffd6e38937af2f09f8cbbeca7477cff906a202ebdcb018e14d8318f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63520.exe

Filesize
184KB

MD5
3a3825df0453fcf0e12c7211db988196

SHA1
8b19e63715fd73971a5fd7a656a6977c6f8b58d2

SHA256
29308d1fedb327a3229349736dce4897a05725b9fffe4a55ad88389dd4194854

SHA512
a0613a312b92233d6c69e6d2db598dc4540b2e6d002ee6aa90be9b477733244240058d0d1b37cd93909057544c23130a270ed11bb9fdedaff1a61d8047c88d17

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64374.exe

Filesize
184KB

MD5
25a89b5bcfd60059287f592d14978f5c

SHA1
21ecf4da69e9e6d1a73db3316bda567a008d4d42

SHA256
39715da56a3775bddbc0b1eb910c0a37e8bf538eefdfbe61ea1b517c78cc25ff

SHA512
772cd552910517028d4b0ec7f816c62426b47632a8f17e2409869f8cf9773d5fcae9bec208df2feabb5f00246a8a48219b88a27ac7e5d44eb7b41a5aacc7cd98

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6913.exe

Filesize
184KB

MD5
a3d2d6f034ac5f8272db1a99cfe2c749

SHA1
37f132ad0c2a4a976d5b7cc74e63e2b3277ace64

SHA256
fb4540fefd0e16b19c59b759400dc88e177fbfaaab350066c083cadce5c28ce3

SHA512
3e265aa716b7d093437fb869317b03856295df19829bb7c49a4347e4e3ac6c627053b6189288849ef490bd5bb0e33f1bc91996a8d1b41bba162f4ae3775b7d01

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7105.exe

Filesize
184KB

MD5
4fddea1b44c3c86a51650fad77601ac0

SHA1
df761b6ae6c6bda47c7417a060fe158edff62e5b

SHA256
0f7cc2f2f3b329d11668ac8f8da826c95ff070ef58f18ec7d1908d2a6f1f88d9

SHA512
84afc4061050c1de00c127713d14cf17fb7828a8cc8ef87c509548f4be59837626a19658f927e7423287fee10be894c173f6fb1326de5a8c3337d5aadeb8d200

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7364.exe

Filesize
184KB

MD5
70756a16e922f5546343e225582b98d2

SHA1
67f7b1cfc00e90ea065eec8cd522a8a323a1058f

SHA256
4f9507c98926d50b6836be42a77d295f4a496d9f58fea67d2e74e5957a20bb66

SHA512
213aba7ad2635275f93a85fa6ff18fc63af5120b59a398aefdd0377923b85c5e45b29b6ac6b35ea4055a397e487a434ee52705b39ab6e04b8620e54ed7286c23

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7451.exe

Filesize
184KB

MD5
654a87528ddfb9c7f44ad3709dbc2015

SHA1
7eb3265f6b4de8370c96f14c64c11e75f4e85ac8

SHA256
d72d50610dd287f353ae453f1e886f8f9472c0d3cfbb9be0d4c6ef55503b7620

SHA512
52fa8f23c484e79218b5c61b7373f8a0cc491b495bb218f3e3ec8eca14c45d114a51aa79c578d7cb137c31082a418b2a494ad5f0a5d135b07431b009c9c0097f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-783.exe

Filesize
184KB

MD5
0de8f93da6c804190d5443c71694a45a

SHA1
850b903e11bd7aeee8b83523000a3dbe05441352

SHA256
aa71d2796ac40456079247ea8718775650b62c6b8f6485376da82eededddee38

SHA512
7e56d3aeba8bb91a6bc036565794ed65e0616d14ac0e020fe07d4a39ccea10e0c3ffbee6c483dfc84ae7eea76cde3cc4122cab5eedead3d0bc1cd47bd6c4b28d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8106.exe

Filesize
184KB

MD5
0063064cb02e05d1fc0d635e73aea27e

SHA1
453a59406f0d50c45a8e27d8c35c84b71138273e

SHA256
5889f7ac029ea9a02247dc7b95a76d70f382adbebe03facbd5448fb6d106cfe4

SHA512
de0bc1dcb6b00e0533d1b4a859c064776bffe9f4c892c3042dc119867742b63d763da086672d6a7cf9406b95eb3a012b47c1ecf9dcece4522ecaa861855c5dc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-946.exe

Filesize
184KB

MD5
6c4debe39948a8e594355e355c072d80

SHA1
6d07feb3439a4610f094bf812a169d194b7b3c42

SHA256
37616d083bf9393450255a4f5e9e2ba10fa5822942e8a9470aa8688cbad442d9

SHA512
274cac42956ef8786d587c82476b995465157cfdb0d0d3ed12d0b919395bf315195daeedc1d080ac38f7dcdc369c5fee5bf7e70335b46c7677f548d1408ecbd8

Download Submit
memory/5956-2890-0x00007FF9FDD90000-0x00007FF9FDF85000-memory.dmp

Filesize
2.0MB

Download
memory/11324-3790-0x0000000075990000-0x00000000759B4000-memory.dmp

Filesize
144KB

Download
memory/19248-3942-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads