7fc2fd84094e931faf410d79dc93178e7cf1babd36764c6be533e6c4f4cf31b6

Analysis

max time kernel
34s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2024, 22:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7fc2fd84094e931faf410d79dc93178e7cf1babd36764c6be533e6c4f4cf31b6N.exe
Size 468KB
Sample241109-16xzbstdnm
SHA256 7fc2fd84094e931faf410d79dc93178e7cf1babd36764c6be533e6c4f4cf31b6
MD5 bc44a0623f1ad2e299b8548c229bb3a0
SHA1 081a1d15701265b8cd7e6da30325bb780fd58b8d
SHA512 379dd12d0c811f58007eaa8a3fe6cfdb4e23c9ae3c7004cbd2cfc1a84385e7cbee759d86f562bbbfb5bc66ca03bb67fb35e3914c3dc39647d2918e23f6637985
SSDEEP 3072:6Ij4ovIwUg5/jYYUPgS7Of8y354D1fXMx8HxRHX+Sd0Verwe8glo:6I0oIQ/juPf7OfOPdUSdMgwe8
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4244	Unicorn-16166.exe
3168	Unicorn-27432.exe
688	Unicorn-3482.exe
3664	Unicorn-45652.exe
4900	Unicorn-10841.exe
3180	Unicorn-4711.exe
1784	Unicorn-17618.exe
3308	Unicorn-61002.exe
3512	Unicorn-56918.exe
1732	Unicorn-55335.exe
2692	Unicorn-9398.exe
3336	Unicorn-55335.exe
3028	Unicorn-3533.exe
3388	Unicorn-42288.exe
2208	Unicorn-25782.exe
2460	Unicorn-63093.exe
1440	Unicorn-17422.exe
4592	Unicorn-17422.exe
4644	Unicorn-25681.exe
3548	Unicorn-11946.exe
2764	Unicorn-31812.exe
3372	Unicorn-27728.exe
2596	Unicorn-53608.exe
2184	Unicorn-52324.exe
3164	Unicorn-58189.exe
4104	Unicorn-27728.exe
3132	Unicorn-57176.exe
4540	Unicorn-42694.exe
1104	Unicorn-32479.exe
2824	Unicorn-483.exe
4200	Unicorn-27126.exe
4800	Unicorn-22226.exe
3920	Unicorn-33924.exe
3064	Unicorn-33924.exe
3156	Unicorn-64650.exe
1940	Unicorn-40700.exe
2708	Unicorn-21480.exe
5060	Unicorn-39192.exe
804	Unicorn-28256.exe
452	Unicorn-28256.exe
956	Unicorn-44038.exe
3648	Unicorn-39954.exe
1656	Unicorn-20088.exe
3788	Unicorn-62247.exe
3996	Unicorn-31786.exe
3888	Unicorn-31786.exe
1156	Unicorn-23426.exe
2492	Unicorn-3560.exe
4460	Unicorn-63497.exe
1688	Unicorn-39854.exe
388	Unicorn-45719.exe
1280	Unicorn-43581.exe
940	Unicorn-43846.exe
4268	Unicorn-50644.exe
3560	Unicorn-22610.exe
4624	Unicorn-3581.exe
2104	Unicorn-64769.exe
4648	Unicorn-27985.exe
4888	Unicorn-18704.exe
3420	Unicorn-47847.exe
992	Unicorn-61490.exe
5084	Unicorn-47655.exe
872	Unicorn-59352.exe
2324	Unicorn-59352.exe

Program crash 8 IoCs

pid	pid_target	Process	procid_target
4000	2460	WerFault.exe	115
9892	5260	WerFault.exe	186
11148	5564	WerFault.exe	221
13716	7152	WerFault.exe	263
2900	15860	WerFault.exe	782
16596	4880	WerFault.exe	812
4600	7016	WerFault.exe	353
720	16464	WerFault.exe	836

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45719.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61490.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-613.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61443.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29970.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11687.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25782.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62247.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59352.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28631.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48536.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40700.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64759.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42222.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15645.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17422.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39192.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31153.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24878.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10217.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11085.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60670.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58189.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13633.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36768.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31786.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43846.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33478.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41957.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44552.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59326.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10893.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45652.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57956.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59352.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54474.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27728.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45630.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40395.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46285.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27832.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56918.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27126.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64650.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47847.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60120.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57176.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39700.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18001.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50893.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33622.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11946.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23426.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44915.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11395.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28256.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43876.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2676	7fc2fd84094e931faf410d79dc93178e7cf1babd36764c6be533e6c4f4cf31b6N.exe
4244	Unicorn-16166.exe
688	Unicorn-3482.exe
3168	Unicorn-27432.exe
3664	Unicorn-45652.exe
3180	Unicorn-4711.exe
4900	Unicorn-10841.exe
1784	Unicorn-17618.exe
3308	Unicorn-61002.exe
3512	Unicorn-56918.exe
3336	Unicorn-55335.exe
2692	Unicorn-9398.exe
1732	Unicorn-55335.exe
3028	Unicorn-3533.exe
3388	Unicorn-42288.exe
2208	Unicorn-25782.exe
2460	Unicorn-63093.exe
1440	Unicorn-17422.exe
4592	Unicorn-17422.exe
3164	Unicorn-58189.exe
4104	Unicorn-27728.exe
2764	Unicorn-31812.exe
2184	Unicorn-52324.exe
3548	Unicorn-11946.exe
3372	Unicorn-27728.exe
2596	Unicorn-53608.exe
4644	Unicorn-25681.exe
3132	Unicorn-57176.exe
4540	Unicorn-42694.exe
1104	Unicorn-32479.exe
2824	Unicorn-483.exe
4200	Unicorn-27126.exe
4800	Unicorn-22226.exe
3064	Unicorn-33924.exe
3920	Unicorn-33924.exe
2708	Unicorn-21480.exe
3156	Unicorn-64650.exe
452	Unicorn-28256.exe
1940	Unicorn-40700.exe
5060	Unicorn-39192.exe
956	Unicorn-44038.exe
3648	Unicorn-39954.exe
3788	Unicorn-62247.exe
3888	Unicorn-31786.exe
3996	Unicorn-31786.exe
1656	Unicorn-20088.exe
804	Unicorn-28256.exe
1156	Unicorn-23426.exe
4460	Unicorn-63497.exe
2492	Unicorn-3560.exe
1688	Unicorn-39854.exe
388	Unicorn-45719.exe
1280	Unicorn-43581.exe
940	Unicorn-43846.exe
4268	Unicorn-50644.exe
3560	Unicorn-22610.exe
4624	Unicorn-3581.exe
2104	Unicorn-64769.exe
4648	Unicorn-27985.exe
4888	Unicorn-18704.exe
3420	Unicorn-47847.exe
992	Unicorn-61490.exe
5084	Unicorn-47655.exe
872	Unicorn-59352.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 4244	2676	7fc2fd84094e931faf410d79dc93178e7cf1babd36764c6be533e6c4f4cf31b6N.exe	94
PID 2676 wrote to memory of 4244	2676	7fc2fd84094e931faf410d79dc93178e7cf1babd36764c6be533e6c4f4cf31b6N.exe	94
PID 2676 wrote to memory of 4244	2676	7fc2fd84094e931faf410d79dc93178e7cf1babd36764c6be533e6c4f4cf31b6N.exe	94
PID 4244 wrote to memory of 3168	4244	Unicorn-16166.exe	97
PID 4244 wrote to memory of 3168	4244	Unicorn-16166.exe	97
PID 4244 wrote to memory of 3168	4244	Unicorn-16166.exe	97
PID 2676 wrote to memory of 688	2676	7fc2fd84094e931faf410d79dc93178e7cf1babd36764c6be533e6c4f4cf31b6N.exe	98
PID 2676 wrote to memory of 688	2676	7fc2fd84094e931faf410d79dc93178e7cf1babd36764c6be533e6c4f4cf31b6N.exe	98
PID 2676 wrote to memory of 688	2676	7fc2fd84094e931faf410d79dc93178e7cf1babd36764c6be533e6c4f4cf31b6N.exe	98
PID 688 wrote to memory of 3664	688	Unicorn-3482.exe	103
PID 688 wrote to memory of 3664	688	Unicorn-3482.exe	103
PID 688 wrote to memory of 3664	688	Unicorn-3482.exe	103
PID 3168 wrote to memory of 4900	3168	Unicorn-27432.exe	104
PID 3168 wrote to memory of 4900	3168	Unicorn-27432.exe	104
PID 3168 wrote to memory of 4900	3168	Unicorn-27432.exe	104
PID 2676 wrote to memory of 3180	2676	7fc2fd84094e931faf410d79dc93178e7cf1babd36764c6be533e6c4f4cf31b6N.exe	105
PID 2676 wrote to memory of 3180	2676	7fc2fd84094e931faf410d79dc93178e7cf1babd36764c6be533e6c4f4cf31b6N.exe	105
PID 2676 wrote to memory of 3180	2676	7fc2fd84094e931faf410d79dc93178e7cf1babd36764c6be533e6c4f4cf31b6N.exe	105
PID 4244 wrote to memory of 1784	4244	Unicorn-16166.exe	106
PID 4244 wrote to memory of 1784	4244	Unicorn-16166.exe	106
PID 4244 wrote to memory of 1784	4244	Unicorn-16166.exe	106
PID 1784 wrote to memory of 3308	1784	Unicorn-17618.exe	107
PID 1784 wrote to memory of 3308	1784	Unicorn-17618.exe	107
PID 1784 wrote to memory of 3308	1784	Unicorn-17618.exe	107
PID 4900 wrote to memory of 3512	4900	Unicorn-10841.exe	108
PID 4900 wrote to memory of 3512	4900	Unicorn-10841.exe	108
PID 4900 wrote to memory of 3512	4900	Unicorn-10841.exe	108
PID 3168 wrote to memory of 1732	3168	Unicorn-27432.exe	109
PID 3168 wrote to memory of 1732	3168	Unicorn-27432.exe	109
PID 3168 wrote to memory of 1732	3168	Unicorn-27432.exe	109
PID 688 wrote to memory of 3336	688	Unicorn-3482.exe	110
PID 688 wrote to memory of 3336	688	Unicorn-3482.exe	110
PID 688 wrote to memory of 3336	688	Unicorn-3482.exe	110
PID 2676 wrote to memory of 2692	2676	7fc2fd84094e931faf410d79dc93178e7cf1babd36764c6be533e6c4f4cf31b6N.exe	111
PID 2676 wrote to memory of 2692	2676	7fc2fd84094e931faf410d79dc93178e7cf1babd36764c6be533e6c4f4cf31b6N.exe	111
PID 2676 wrote to memory of 2692	2676	7fc2fd84094e931faf410d79dc93178e7cf1babd36764c6be533e6c4f4cf31b6N.exe	111
PID 4244 wrote to memory of 3028	4244	Unicorn-16166.exe	112
PID 4244 wrote to memory of 3028	4244	Unicorn-16166.exe	112
PID 4244 wrote to memory of 3028	4244	Unicorn-16166.exe	112
PID 3180 wrote to memory of 3388	3180	Unicorn-4711.exe	113
PID 3180 wrote to memory of 3388	3180	Unicorn-4711.exe	113
PID 3180 wrote to memory of 3388	3180	Unicorn-4711.exe	113
PID 3308 wrote to memory of 2208	3308	Unicorn-61002.exe	114
PID 3308 wrote to memory of 2208	3308	Unicorn-61002.exe	114
PID 3308 wrote to memory of 2208	3308	Unicorn-61002.exe	114
PID 1784 wrote to memory of 2460	1784	Unicorn-17618.exe	115
PID 1784 wrote to memory of 2460	1784	Unicorn-17618.exe	115
PID 1784 wrote to memory of 2460	1784	Unicorn-17618.exe	115
PID 3512 wrote to memory of 1440	3512	Unicorn-56918.exe	116
PID 3512 wrote to memory of 1440	3512	Unicorn-56918.exe	116
PID 3512 wrote to memory of 1440	3512	Unicorn-56918.exe	116
PID 3336 wrote to memory of 4592	3336	Unicorn-55335.exe	117
PID 3336 wrote to memory of 4592	3336	Unicorn-55335.exe	117
PID 3336 wrote to memory of 4592	3336	Unicorn-55335.exe	117
PID 688 wrote to memory of 4644	688	Unicorn-3482.exe	118
PID 688 wrote to memory of 4644	688	Unicorn-3482.exe	118
PID 688 wrote to memory of 4644	688	Unicorn-3482.exe	118
PID 4900 wrote to memory of 3548	4900	Unicorn-10841.exe	119
PID 4900 wrote to memory of 3548	4900	Unicorn-10841.exe	119
PID 4900 wrote to memory of 3548	4900	Unicorn-10841.exe	119
PID 2692 wrote to memory of 2764	2692	Unicorn-9398.exe	120
PID 2692 wrote to memory of 2764	2692	Unicorn-9398.exe	120
PID 2692 wrote to memory of 2764	2692	Unicorn-9398.exe	120
PID 3028 wrote to memory of 3372	3028	Unicorn-3533.exe	122

C:\Users\Admin\AppData\Local\Temp\7fc2fd84094e931faf410d79dc93178e7cf1babd36764c6be533e6c4f4cf31b6N.exe
"C:\Users\Admin\AppData\Local\Temp\7fc2fd84094e931faf410d79dc93178e7cf1babd36764c6be533e6c4f4cf31b6N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16166.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16166.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27432.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27432.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10841.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56918.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17422.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-483.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18704.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11687.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17090.exe
        10⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49560.exe
        11⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8296.exe
        11⤵
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29369.exe
        11⤵
        
        PID:9240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31536.exe
        10⤵
        
        PID:9356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6482.exe
        10⤵
        
        PID:13920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33067.exe
        10⤵
        
        PID:17540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13944.exe
        9⤵
        
        PID:8140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-948.exe
        10⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51302.exe
        9⤵
        
        PID:9960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35865.exe
        9⤵
        
        PID:13560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42942.exe
        9⤵
        
        PID:16672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3669.exe
        9⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63581.exe
        8⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36872.exe
        9⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30458.exe
        10⤵
        
        PID:14780
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7016 -s 648
        10⤵
        Program crash
        
        PID:4600
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5564 -s 636
        9⤵
        Program crash
        
        PID:11148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7581.exe
        8⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63711.exe
        8⤵
        
        PID:12044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25611.exe
        8⤵
        
        PID:15356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47847.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44552.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55704.exe
        9⤵
        
        PID:9148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61983.exe
        9⤵
        
        PID:13160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22223.exe
        9⤵
        
        PID:15996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19667.exe
        9⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59383.exe
        8⤵
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12729.exe
        8⤵
        
        PID:10996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34799.exe
        8⤵
        
        PID:15132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26228.exe
        8⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18001.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32248.exe
        8⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49132.exe
        9⤵
        
        PID:16740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59199.exe
        9⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62130.exe
        9⤵
        
        PID:7964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7416.exe
        8⤵
        
        PID:9108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13088.exe
        8⤵
        
        PID:14116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25498.exe
        8⤵
        
        PID:17496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18324.exe
        7⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43816.exe
        7⤵
        
        PID:10880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33388.exe
        7⤵
        
        PID:13876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10919.exe
        7⤵
        
        PID:6452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22226.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15003.exe
        7⤵
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59326.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20510.exe
        9⤵
        
        PID:8356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44879.exe
        9⤵
        
        PID:11772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-651.exe
        9⤵
        
        PID:15556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30855.exe
        9⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40716.exe
        8⤵
        
        PID:8932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61930.exe
        8⤵
        
        PID:10076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42445.exe
        8⤵
        
        PID:14716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48122.exe
        8⤵
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35376.exe
        7⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32570.exe
        8⤵
        
        PID:8816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38656.exe
        8⤵
        
        PID:12340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35270.exe
        8⤵
        
        PID:15872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22575.exe
        7⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13219.exe
        7⤵
        
        PID:12480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6204.exe
        7⤵
        
        PID:16160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30618.exe
        7⤵
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10727.exe
        7⤵
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45630.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12071.exe
        7⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19336.exe
        8⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34350.exe
        9⤵
        
        PID:15196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34719.exe
        9⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59600.exe
        8⤵
        
        PID:11620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47244.exe
        8⤵
        
        PID:16092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50924.exe
        8⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58231.exe
        7⤵
        
        PID:7988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62972.exe
        8⤵
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40724.exe
        8⤵
        
        PID:16392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14875.exe
        8⤵
        
        PID:17820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57681.exe
        7⤵
        
        PID:11960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30708.exe
        7⤵
        
        PID:16236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13441.exe
        7⤵
        
        PID:7640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42917.exe
        6⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41314.exe
        7⤵
        
        PID:8940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6368.exe
        7⤵
        
        PID:12452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25539.exe
        7⤵
        
        PID:16180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9633.exe
        6⤵
        
        PID:1268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44924.exe
        6⤵
        
        PID:11592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57120.exe
        6⤵
        
        PID:15476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36118.exe
        6⤵
        
        PID:6404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11946.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31786.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51952.exe
        7⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60670.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27220.exe
        9⤵
        
        PID:11912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29066.exe
        9⤵
        
        PID:15260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34363.exe
        9⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39346.exe
        8⤵
        
        PID:8684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52392.exe
        8⤵
        
        PID:12332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14492.exe
        8⤵
        
        PID:15860
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15860 -s 464
        9⤵
        Program crash
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11427.exe
        8⤵
        
        PID:18272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24468.exe
        7⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40188.exe
        8⤵
        
        PID:14880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34719.exe
        8⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47820.exe
        7⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64453.exe
        7⤵
        
        PID:11236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52864.exe
        7⤵
        
        PID:16812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30454.exe
        7⤵
        
        PID:9772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34800.exe
        6⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49378.exe
        7⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44656.exe
        8⤵
        
        PID:15020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44834.exe
        8⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16378.exe
        7⤵
        
        PID:10196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30603.exe
        7⤵
        
        PID:14124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-731.exe
        7⤵
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6152.exe
        7⤵
        
        PID:17324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24385.exe
        7⤵
        
        PID:7552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56076.exe
        6⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63400.exe
        7⤵
        
        PID:11820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55133.exe
        7⤵
        
        PID:14652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33175.exe
        7⤵
        
        PID:9400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39540.exe
        6⤵
        
        PID:11260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27166.exe
        6⤵
        
        PID:14476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60358.exe
        6⤵
        
        PID:17380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64884.exe
        6⤵
        
        PID:17768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39854.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40276.exe
        6⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13607.exe
        7⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27858.exe
        8⤵
        
        PID:10988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
        8⤵
        
        PID:13460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42531.exe
        8⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30000.exe
        7⤵
        
        PID:8532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50420.exe
        7⤵
        
        PID:13060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
        7⤵
        
        PID:16864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46990.exe
        7⤵
        
        PID:17760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39129.exe
        6⤵
        
        PID:1912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56260.exe
        6⤵
        
        PID:11400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49532.exe
        6⤵
        
        PID:14692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25340.exe
        6⤵
        
        PID:7124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41957.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48418.exe
        6⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20596.exe
        7⤵
        
        PID:15024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48918.exe
        7⤵
        
        PID:5556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34084.exe
        6⤵
        
        PID:9488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7441.exe
        6⤵
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
        6⤵
        
        PID:16784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34737.exe
        6⤵
        
        PID:1892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56400.exe
        5⤵
        
        PID:6852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29062.exe
        6⤵
        
        PID:9088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37286.exe
        6⤵
        
        PID:13228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36614.exe
        6⤵
        
        PID:16140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27269.exe
        6⤵
        
        PID:17360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19667.exe
        6⤵
        
        PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37036.exe
        5⤵
        
        PID:9460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
        5⤵
        
        PID:13004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31863.exe
        5⤵
        
        PID:16832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34748.exe
        5⤵
        
        PID:15736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55335.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27728.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33924.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59352.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30738.exe
        8⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42278.exe
        9⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15634.exe
        10⤵
        
        PID:9120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45018.exe
        9⤵
        
        PID:11872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9196.exe
        9⤵
        
        PID:14676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17906.exe
        9⤵
        
        PID:7308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52393.exe
        8⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-123.exe
        9⤵
        
        PID:17112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35182.exe
        9⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52454.exe
        8⤵
        
        PID:10160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52367.exe
        8⤵
        
        PID:10968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3132.exe
        8⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11369.exe
        7⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38740.exe
        8⤵
        
        PID:10756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
        8⤵
        
        PID:13608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43107.exe
        8⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47271.exe
        7⤵
        
        PID:9076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25663.exe
        7⤵
        
        PID:13268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62203.exe
        7⤵
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64235.exe
        7⤵
        
        PID:17940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46285.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34822.exe
        7⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19804.exe
        8⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34542.exe
        9⤵
        
        PID:13676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22467.exe
        9⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7416.exe
        8⤵
        
        PID:10128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53134.exe
        8⤵
        
        PID:13656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27504.exe
        7⤵
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1499.exe
        7⤵
        
        PID:10760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25149.exe
        7⤵
        
        PID:7720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34721.exe
        6⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61568.exe
        7⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55247.exe
        7⤵
        
        PID:10952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44556.exe
        7⤵
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42034.exe
        7⤵
        
        PID:9500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62455.exe
        6⤵
        
        PID:8672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30541.exe
        6⤵
        
        PID:12112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23466.exe
        6⤵
        
        PID:15220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29393.exe
        6⤵
        
        PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28256.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48060.exe
        6⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11085.exe
        7⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19804.exe
        8⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7416.exe
        8⤵
        
        PID:8892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22407.exe
        8⤵
        
        PID:13688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21264.exe
        8⤵
        
        PID:16516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34737.exe
        8⤵
        
        PID:17700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37618.exe
        7⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63711.exe
        7⤵
        
        PID:12052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18264.exe
        7⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64204.exe
        7⤵
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18438.exe
        6⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18767.exe
        7⤵
        
        PID:4584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8925.exe
        6⤵
        
        PID:7140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64453.exe
        6⤵
        
        PID:11896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52864.exe
        6⤵
        
        PID:16752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43876.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3493.exe
        6⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58584.exe
        7⤵
        
        PID:10456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
        7⤵
        
        PID:444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34737.exe
        7⤵
        
        PID:3088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34084.exe
        6⤵
        
        PID:9480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45185.exe
        6⤵
        
        PID:13984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31649.exe
        6⤵
        
        PID:17280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26171.exe
        5⤵
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57214.exe
        6⤵
        
        PID:9956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
        6⤵
        
        PID:13916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54068.exe
        6⤵
        
        PID:17556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16815.exe
        5⤵
        
        PID:9360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18832.exe
        5⤵
        
        PID:11680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6139.exe
        5⤵
        
        PID:17204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64884.exe
        5⤵
        
        PID:17708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52324.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39954.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60120.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10893.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36270.exe
        8⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50525.exe
        8⤵
        
        PID:11584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21263.exe
        8⤵
        
        PID:16192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19667.exe
        8⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59959.exe
        7⤵
        
        PID:8496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63493.exe
        7⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19231.exe
        7⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30888.exe
        7⤵
        
        PID:6920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22330.exe
        6⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40738.exe
        7⤵
        
        PID:8616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49460.exe
        7⤵
        
        PID:12088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27897.exe
        7⤵
        
        PID:13728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34737.exe
        7⤵
        
        PID:944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12241.exe
        6⤵
        
        PID:8392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52227.exe
        6⤵
        
        PID:11816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63388.exe
        6⤵
        
        PID:15568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28020.exe
        6⤵
        
        PID:17320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61443.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15252.exe
        6⤵
        
        PID:8260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59600.exe
        6⤵
        
        PID:11612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47244.exe
        6⤵
        
        PID:16204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5569.exe
        6⤵
        
        PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41240.exe
        5⤵
        
        PID:8048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7364.exe
        5⤵
        
        PID:10776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43126.exe
        5⤵
        
        PID:7724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34972.exe
        5⤵
        
        PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62247.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27448.exe
        5⤵
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33452.exe
        6⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-473.exe
        7⤵
        
        PID:8880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18812.exe
        7⤵
        
        PID:12412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17179.exe
        7⤵
        
        PID:16280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46118.exe
        7⤵
        
        PID:16392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40036.exe
        6⤵
        
        PID:9516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56285.exe
        6⤵
        
        PID:13052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52864.exe
        6⤵
        
        PID:16760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27182.exe
        5⤵
        
        PID:3676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44578.exe
        6⤵
        
        PID:11480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50044.exe
        6⤵
        
        PID:16000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40585.exe
        6⤵
        
        PID:2276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46669.exe
        5⤵
        
        PID:9900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39260.exe
        5⤵
        
        PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54611.exe
        5⤵
        
        PID:17232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24089.exe
        5⤵
        
        PID:2996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28631.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60670.exe
        5⤵
        
        PID:6856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7634.exe
        6⤵
        
        PID:8348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10565.exe
        6⤵
        
        PID:11836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27897.exe
        6⤵
        
        PID:15036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47515.exe
        5⤵
        
        PID:8536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63493.exe
        5⤵
        
        PID:2192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19231.exe
        5⤵
        
        PID:3392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53015.exe
        5⤵
        
        PID:2204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37342.exe
      4⤵
      PID:6184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24480.exe
        5⤵
        
        PID:13036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8296.exe
        5⤵
        
        PID:15824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41466.exe
      4⤵
      PID:8648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26619.exe
      4⤵
      PID:13020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26528.exe
      4⤵
      PID:16844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3562.exe
      4⤵
      PID:6420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17618.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17618.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61002.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25782.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27126.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61490.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20624.exe
        8⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64536.exe
        9⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17080.exe
        10⤵
        
        PID:11580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12764.exe
        10⤵
        
        PID:16608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41326.exe
        10⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17722.exe
        9⤵
        
        PID:10116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28629.exe
        9⤵
        
        PID:13616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3132.exe
        9⤵
        
        PID:15868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51930.exe
        8⤵
        
        PID:8572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14121.exe
        9⤵
        
        PID:15236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34719.exe
        9⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49513.exe
        8⤵
        
        PID:12000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30708.exe
        8⤵
        
        PID:16016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64235.exe
        8⤵
        
        PID:17932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27208.exe
        7⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5159.exe
        8⤵
        
        PID:9032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18349.exe
        8⤵
        
        PID:13080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52593.exe
        8⤵
        
        PID:16312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42610.exe
        8⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7581.exe
        7⤵
        
        PID:8636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44834.exe
        8⤵
        
        PID:7496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30847.exe
        7⤵
        
        PID:12196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27557.exe
        7⤵
        
        PID:15252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61038.exe
        7⤵
        
        PID:1240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47655.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36768.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3275.exe
        8⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17530.exe
        8⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40882.exe
        8⤵
        
        PID:13720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13822.exe
        8⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10976.exe
        7⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57681.exe
        7⤵
        
        PID:11952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30708.exe
        7⤵
        
        PID:16108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64204.exe
        7⤵
        
        PID:6120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10217.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46254.exe
        7⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48932.exe
        8⤵
        
        PID:15276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22467.exe
        8⤵
        
        PID:16024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7416.exe
        7⤵
        
        PID:9104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22407.exe
        7⤵
        
        PID:13680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35268.exe
        7⤵
        
        PID:1896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50997.exe
        6⤵
        
        PID:7452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21065.exe
        6⤵
        
        PID:11192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27166.exe
        6⤵
        
        PID:13704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64204.exe
        6⤵
        
        PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40700.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39700.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11085.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49098.exe
        8⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55185.exe
        8⤵
        
        PID:11920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59966.exe
        8⤵
        
        PID:15716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53221.exe
        8⤵
        
        PID:16172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64235.exe
        7⤵
        
        PID:8268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
        7⤵
        
        PID:11636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65255.exe
        7⤵
        
        PID:15504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42444.exe
        7⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28596.exe
        7⤵
        
        PID:18076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40804.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8911.exe
        7⤵
        
        PID:11728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46205.exe
        7⤵
        
        PID:16776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1855.exe
        7⤵
        
        PID:17360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61250.exe
        6⤵
        
        PID:8544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54828.exe
        6⤵
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13002.exe
        6⤵
        
        PID:2236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27100.exe
        6⤵
        
        PID:9852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50893.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51262.exe
        6⤵
        
        PID:7804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10130.exe
        6⤵
        
        PID:11164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46502.exe
        6⤵
        
        PID:1800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3139.exe
        6⤵
        
        PID:17836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45430.exe
        5⤵
        
        PID:9080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34234.exe
        5⤵
        
        PID:8944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59491.exe
        5⤵
        
        PID:15448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19898.exe
        5⤵
        
        PID:6292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63093.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2460
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 484
        5⤵
        Program crash
        
        PID:4000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27985.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29778.exe
        5⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10099.exe
        6⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40110.exe
        7⤵
        
        PID:10252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
        7⤵
        
        PID:2420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42828.exe
        6⤵
        
        PID:9300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7441.exe
        6⤵
        
        PID:13172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
        6⤵
        
        PID:16732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44400.exe
        5⤵
        
        PID:6836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18320.exe
        6⤵
        
        PID:10040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
        6⤵
        
        PID:14408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6629.exe
        6⤵
        
        PID:4108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40585.exe
        6⤵
        
        PID:16676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27017.exe
        5⤵
        
        PID:10388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2093.exe
        5⤵
        
        PID:7660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27558.exe
        5⤵
        
        PID:4516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40395.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38562.exe
        5⤵
        
        PID:7464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12209.exe
        6⤵
        
        PID:16532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48717.exe
        6⤵
        
        PID:18300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48013.exe
        5⤵
        
        PID:10468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2093.exe
        5⤵
        
        PID:7880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37400.exe
        5⤵
        
        PID:18228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7199.exe
      4⤵
      PID:6596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31112.exe
        5⤵
        
        PID:12220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37600.exe
        5⤵
        
        PID:15300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4107.exe
      4⤵
      PID:9580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34979.exe
      4⤵
      PID:13484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10576.exe
      4⤵
      PID:9056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
      4⤵
      PID:2912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3533.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3533.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27728.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44038.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50006.exe
        6⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11661.exe
        7⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1215.exe
        8⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
        8⤵
        
        PID:14060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44888.exe
        7⤵
        
        PID:9468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47925.exe
        7⤵
        
        PID:12472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5609.exe
        7⤵
        
        PID:17304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22862.exe
        7⤵
        
        PID:9780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18822.exe
        6⤵
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49394.exe
        7⤵
        
        PID:11684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50044.exe
        7⤵
        
        PID:16128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33256.exe
        7⤵
        
        PID:18256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25645.exe
        6⤵
        
        PID:9408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27166.exe
        6⤵
        
        PID:14424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21033.exe
        6⤵
        
        PID:6828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17696.exe
        5⤵
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6809.exe
        6⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61158.exe
        7⤵
        
        PID:9188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22128.exe
        7⤵
        
        PID:11504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22825.exe
        7⤵
        
        PID:15312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63983.exe
        7⤵
        
        PID:17548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29232.exe
        6⤵
        
        PID:6544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3383.exe
        6⤵
        
        PID:11968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-294.exe
        6⤵
        
        PID:15728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11883.exe
        6⤵
        
        PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15645.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29856.exe
        6⤵
        
        PID:8992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64531.exe
        6⤵
        
        PID:12276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30357.exe
        6⤵
        
        PID:15244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6848.exe
        6⤵
        
        PID:1980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1578.exe
        5⤵
        
        PID:8584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27225.exe
        5⤵
        
        PID:11992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40630.exe
        5⤵
        
        PID:15740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26804.exe
        5⤵
        
        PID:4516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3560.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29970.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22264.exe
        6⤵
        
        PID:6148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3462.exe
        6⤵
        
        PID:11468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16411.exe
        6⤵
        
        PID:15216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29599.exe
        6⤵
        
        PID:17112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24841.exe
        6⤵
        
        PID:18264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13498.exe
        5⤵
        
        PID:7260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7529.exe
        5⤵
        
        PID:11244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52367.exe
        5⤵
        
        PID:13700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17330.exe
        5⤵
        
        PID:6308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38038.exe
      4⤵
      PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53846.exe
        5⤵
        
        PID:7992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40110.exe
        6⤵
        
        PID:10004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
        6⤵
        
        PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15008.exe
        5⤵
        
        PID:9692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58780.exe
        5⤵
        
        PID:13500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45577.exe
        5⤵
        
        PID:16572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1448.exe
      4⤵
      PID:7540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4233.exe
        5⤵
        
        PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        5⤵
        
        PID:6616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18735.exe
      4⤵
      PID:10484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51095.exe
      4⤵
      PID:12992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1500.exe
      4⤵
      PID:5352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58189.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58189.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33924.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-613.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38906.exe
        6⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5927.exe
        7⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49460.exe
        7⤵
        
        PID:12076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27897.exe
        7⤵
        
        PID:13744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42444.exe
        7⤵
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59383.exe
        6⤵
        
        PID:8620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33341.exe
        6⤵
        
        PID:12104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48667.exe
        6⤵
        
        PID:15324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29582.exe
        6⤵
        
        PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33430.exe
        5⤵
        
        PID:5132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50338.exe
        6⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39472.exe
        7⤵
        
        PID:12160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16622.exe
        7⤵
        
        PID:14948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40585.exe
        7⤵
        
        PID:6960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50203.exe
        6⤵
        
        PID:10316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20269.exe
        6⤵
        
        PID:14072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3132.exe
        6⤵
        
        PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41240.exe
        5⤵
        
        PID:8040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23864.exe
        6⤵
        
        PID:3848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48918.exe
        6⤵
        
        PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49016.exe
        5⤵
        
        PID:11944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47774.exe
        5⤵
        
        PID:16148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62948.exe
        5⤵
        
        PID:16552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50508.exe
        5⤵
        
        PID:6300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64759.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53296.exe
        5⤵
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15527.exe
        6⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4020.exe
        7⤵
        
        PID:15392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28333.exe
        7⤵
        
        PID:11176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50203.exe
        6⤵
        
        PID:10308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20269.exe
        6⤵
        
        PID:14080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15618.exe
        6⤵
        
        PID:17352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15384.exe
        6⤵
        
        PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42392.exe
        5⤵
        
        PID:8808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52824.exe
        6⤵
        
        PID:14596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53194.exe
        6⤵
        
        PID:7364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15549.exe
        5⤵
        
        PID:13064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2888.exe
        5⤵
        
        PID:4880
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 472
        6⤵
        Program crash
        
        PID:16596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26228.exe
        5⤵
        
        PID:5672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8079.exe
      4⤵
      PID:5252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30842.exe
        5⤵
        
        PID:8152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63415.exe
        5⤵
        
        PID:10344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46502.exe
        5⤵
        
        PID:13528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54942.exe
      4⤵
      PID:9008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-768.exe
      4⤵
      PID:12460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35522.exe
      4⤵
      PID:16120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9087.exe
      4⤵
      PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58868.exe
      4⤵
      PID:16168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39192.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39192.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-805.exe
      4⤵
      PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7001.exe
        5⤵
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41148.exe
        6⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2095.exe
        7⤵
        
        PID:16464
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16464 -s 472
        8⤵
        Program crash
        
        PID:720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56868.exe
        7⤵
        
        PID:17532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55247.exe
        6⤵
        
        PID:10944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44556.exe
        6⤵
        
        PID:1404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37532.exe
        6⤵
        
        PID:17572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12128.exe
        5⤵
        
        PID:8688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24981.exe
        5⤵
        
        PID:12204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61442.exe
        5⤵
        
        PID:1664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15532.exe
      4⤵
      PID:6700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7297.exe
        5⤵
        
        PID:8884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48195.exe
        5⤵
        
        PID:10924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36580.exe
        5⤵
        
        PID:14620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31919.exe
        5⤵
        
        PID:17828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47052.exe
      4⤵
      PID:8444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9248.exe
      4⤵
      PID:12068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57166.exe
      4⤵
      PID:15764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3132.exe
      4⤵
      PID:15944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12096.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12096.exe
    3⤵
    PID:5176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53633.exe
      4⤵
      PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11633.exe
        5⤵
        
        PID:15564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48918.exe
        5⤵
        
        PID:17348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30113.exe
      4⤵
      PID:10068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44033.exe
      4⤵
      PID:13276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52864.exe
      4⤵
      PID:16884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33666.exe
      4⤵
      PID:2092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9291.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9291.exe
    3⤵
    PID:6924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46000.exe
      4⤵
      PID:8508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30458.exe
        5⤵
        
        PID:15336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13890.exe
        5⤵
        
        PID:17376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47356.exe
        5⤵
        
        PID:5632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39450.exe
      4⤵
      PID:11844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3331.exe
      4⤵
      PID:14660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19667.exe
      4⤵
      PID:5240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17221.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17221.exe
    3⤵
    PID:5004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46006.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46006.exe
    3⤵
    PID:11668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34454.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34454.exe
    3⤵
    PID:15484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28014.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28014.exe
    3⤵
    PID:6944
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3482.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3482.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45652.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45652.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57176.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43846.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36000.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49570.exe
        7⤵
        
        PID:8020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59238.exe
        8⤵
        
        PID:15008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5722.exe
        8⤵
        
        PID:16456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53298.exe
        8⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17722.exe
        7⤵
        
        PID:10048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36222.exe
        7⤵
        
        PID:13588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13288.exe
        7⤵
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15511.exe
        7⤵
        
        PID:17712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30856.exe
        6⤵
        
        PID:7604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9283.exe
        6⤵
        
        PID:10532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61521.exe
        6⤵
        
        PID:13932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24851.exe
        6⤵
        
        PID:17344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30272.exe
        6⤵
        
        PID:16708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-161.exe
        6⤵
        
        PID:6180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56975.exe
        5⤵
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11661.exe
        6⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4609.exe
        7⤵
        
        PID:13532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40585.exe
        7⤵
        
        PID:15864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34084.exe
        6⤵
        
        PID:6528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50420.exe
        6⤵
        
        PID:13088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
        6⤵
        
        PID:16856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63736.exe
        6⤵
        
        PID:18280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3777.exe
        5⤵
        
        PID:7068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48470.exe
        6⤵
        
        PID:10204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
        6⤵
        
        PID:14100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50699.exe
        6⤵
        
        PID:8200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13036.exe
        5⤵
        
        PID:9700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35367.exe
        5⤵
        
        PID:11488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54611.exe
        5⤵
        
        PID:17296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24665.exe
        5⤵
        
        PID:7448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43581.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34054.exe
        5⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55216.exe
        6⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28242.exe
        7⤵
        
        PID:11564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50044.exe
        7⤵
        
        PID:16100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42636.exe
        6⤵
        
        PID:9448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7441.exe
        6⤵
        
        PID:13292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
        6⤵
        
        PID:16796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39398.exe
        6⤵
        
        PID:9760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58101.exe
        5⤵
        
        PID:7416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20344.exe
        6⤵
        
        PID:15304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44834.exe
        6⤵
        
        PID:6212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65308.exe
        5⤵
        
        PID:9420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47925.exe
        5⤵
        
        PID:12488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5609.exe
        5⤵
        
        PID:17212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26370.exe
        5⤵
        
        PID:9284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31153.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3877.exe
        5⤵
        
        PID:6696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38740.exe
        6⤵
        
        PID:10784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
        6⤵
        
        PID:14340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41440.exe
        6⤵
        
        PID:16588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49792.exe
        6⤵
        
        PID:17748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5880.exe
        5⤵
        
        PID:9368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38168.exe
        5⤵
        
        PID:9264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8436.exe
        5⤵
        
        PID:16696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29942.exe
      4⤵
      PID:7608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9.exe
        5⤵
        
        PID:4732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9945.exe
      4⤵
      PID:8460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18259.exe
      4⤵
      PID:12832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44810.exe
      4⤵
      PID:17172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9592.exe
      4⤵
      PID:17276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55335.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55335.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17422.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21480.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59352.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20728.exe
        8⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55764.exe
        9⤵
        
        PID:16620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51519.exe
        9⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53301.exe
        8⤵
        
        PID:10816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17913.exe
        8⤵
        
        PID:13568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59383.exe
        7⤵
        
        PID:8700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24981.exe
        7⤵
        
        PID:12212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36223.exe
        7⤵
        
        PID:15284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16902.exe
        6⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9435.exe
        7⤵
        
        PID:9012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18349.exe
        7⤵
        
        PID:13108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54731.exe
        7⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11300.exe
        7⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54452.exe
        6⤵
        
        PID:8924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2258.exe
        6⤵
        
        PID:10888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33779.exe
        6⤵
        
        PID:14600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28366.exe
        6⤵
        
        PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61172.exe
        5⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44910.exe
        6⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21714.exe
        7⤵
        
        PID:14980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5722.exe
        7⤵
        
        PID:16604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14403.exe
        7⤵
        
        PID:7968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58973.exe
        6⤵
        
        PID:9708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38168.exe
        6⤵
        
        PID:2880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
        6⤵
        
        PID:16744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49113.exe
        5⤵
        
        PID:7216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57326.exe
        6⤵
        
        PID:16404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22930.exe
        6⤵
        
        PID:7380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27313.exe
        5⤵
        
        PID:10148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55589.exe
        5⤵
        
        PID:12152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4193.exe
        5⤵
        
        PID:17068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25989.exe
        5⤵
        
        PID:9248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20088.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33478.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6809.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46254.exe
        7⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40110.exe
        8⤵
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
        8⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28333.exe
        8⤵
        
        PID:11188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7416.exe
        7⤵
        
        PID:9296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13088.exe
        7⤵
        
        PID:14108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48056.exe
        7⤵
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43841.exe
        6⤵
        
        PID:7948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56154.exe
        6⤵
        
        PID:10656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59767.exe
        6⤵
        
        PID:13340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44094.exe
        6⤵
        
        PID:3924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16300.exe
        5⤵
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51296.exe
        6⤵
        
        PID:14968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43350.exe
        6⤵
        
        PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43736.exe
        5⤵
        
        PID:8852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36519.exe
        5⤵
        
        PID:13996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15114.exe
        5⤵
        
        PID:16564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39928.exe
        5⤵
        
        PID:9824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
      4⤵
      PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2315.exe
        5⤵
        
        PID:7340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42710.exe
        6⤵
        
        PID:14516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34719.exe
        6⤵
        
        PID:5648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55273.exe
        5⤵
        
        PID:9000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27669.exe
        5⤵
        
        PID:9896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12328.exe
        5⤵
        
        PID:17080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63736.exe
        5⤵
        
        PID:18288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57857.exe
      4⤵
      PID:7808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22944.exe
        5⤵
        
        PID:11156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22844.exe
        5⤵
        
        PID:14668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59059.exe
        5⤵
        
        PID:5692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3577.exe
      4⤵
      PID:9588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39444.exe
      4⤵
      PID:13476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37442.exe
      4⤵
      PID:16604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15698.exe
      4⤵
      PID:5908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23426.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44360.exe
        5⤵
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42388.exe
        6⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8013.exe
        7⤵
        
        PID:10032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
        7⤵
        
        PID:13992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40585.exe
        7⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34084.exe
        6⤵
        
        PID:8900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41292.exe
        6⤵
        
        PID:12292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27897.exe
        6⤵
        
        PID:15496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1489.exe
        6⤵
        
        PID:16240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10654.exe
        5⤵
        
        PID:6772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48932.exe
        6⤵
        
        PID:14772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44834.exe
        6⤵
        
        PID:16596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56372.exe
        5⤵
        
        PID:9428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36519.exe
        5⤵
        
        PID:14004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15114.exe
        5⤵
        
        PID:9056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64204.exe
        5⤵
        
        PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44915.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10099.exe
        5⤵
        
        PID:6324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51044.exe
        6⤵
        
        PID:8960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44687.exe
        6⤵
        
        PID:12376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35270.exe
        6⤵
        
        PID:15880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30279.exe
        6⤵
        
        PID:6176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51494.exe
        5⤵
        
        PID:10108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17774.exe
        5⤵
        
        PID:13376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61608.exe
        5⤵
        
        PID:16476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46648.exe
        5⤵
        
        PID:3748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43248.exe
      4⤵
      PID:7208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5875.exe
        5⤵
        
        PID:10600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36658.exe
        5⤵
        
        PID:13348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10897.exe
        5⤵
        
        PID:1696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35979.exe
      4⤵
      PID:10132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6587.exe
      4⤵
      PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52665.exe
      4⤵
      PID:17024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9009.exe
      4⤵
      PID:8664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45719.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45719.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42222.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47432.exe
        5⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5299.exe
        6⤵
        
        PID:10384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
        6⤵
        
        PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16378.exe
        5⤵
        
        PID:10180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1219.exe
        5⤵
        
        PID:11324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12328.exe
        5⤵
        
        PID:17088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4816.exe
      4⤵
      PID:7624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37866.exe
        5⤵
        
        PID:16724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1140.exe
        5⤵
        
        PID:6152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12215.exe
      4⤵
      PID:8868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47925.exe
      4⤵
      PID:12524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5609.exe
      4⤵
      PID:17220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39514.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39514.exe
    3⤵
    PID:5740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
      4⤵
      PID:7588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5157.exe
        5⤵
        
        PID:8504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61085.exe
      4⤵
      PID:10524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55656.exe
      4⤵
      PID:13924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12133.exe
      4⤵
      PID:2032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15490.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15490.exe
    3⤵
    PID:7828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27626.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27626.exe
    3⤵
    PID:9996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22701.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22701.exe
    3⤵
    PID:13644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3562.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3562.exe
    3⤵
    PID:16636
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4711.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4711.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42288.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42288.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42694.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50644.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27832.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1931.exe
        7⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58584.exe
        8⤵
        
        PID:10516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
        8⤵
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54783.exe
        8⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40690.exe
        7⤵
        
        PID:9332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50420.exe
        7⤵
        
        PID:13116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
        7⤵
        
        PID:16820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18822.exe
        6⤵
        
        PID:6680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56372.exe
        6⤵
        
        PID:9436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56285.exe
        6⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3663.exe
        6⤵
        
        PID:17036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24878.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51324.exe
        6⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33040.exe
        7⤵
        
        PID:15364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9998.exe
        7⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42198.exe
        7⤵
        
        PID:6748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51573.exe
        6⤵
        
        PID:9456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42060.exe
        6⤵
        
        PID:12324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14274.exe
        6⤵
        
        PID:17196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13253.exe
        6⤵
        
        PID:5948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48292.exe
        5⤵
        
        PID:8092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57326.exe
        6⤵
        
        PID:16412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48883.exe
        6⤵
        
        PID:9872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34609.exe
        5⤵
        
        PID:10028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46818.exe
        5⤵
        
        PID:13572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20311.exe
        5⤵
        
        PID:17020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4697.exe
        5⤵
        
        PID:7048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22610.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33622.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46254.exe
        6⤵
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7416.exe
        6⤵
        
        PID:7176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13088.exe
        6⤵
        
        PID:10736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22303.exe
        6⤵
        
        PID:16768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3132.exe
        6⤵
        
        PID:16708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30741.exe
        5⤵
        
        PID:6776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6179.exe
        6⤵
        
        PID:1896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34196.exe
        6⤵
        
        PID:18132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35761.exe
        5⤵
        
        PID:9576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43702.exe
        5⤵
        
        PID:7408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34396.exe
        5⤵
        
        PID:16420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11395.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49378.exe
        5⤵
        
        PID:7192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23864.exe
        6⤵
        
        PID:1260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29013.exe
        6⤵
        
        PID:3516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16378.exe
        5⤵
        
        PID:10096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9387.exe
        5⤵
        
        PID:12096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12328.exe
        5⤵
        
        PID:17104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45132.exe
        5⤵
        
        PID:7584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4572.exe
      4⤵
      PID:7748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61410.exe
        5⤵
        
        PID:15200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31098.exe
        5⤵
        
        PID:460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42472.exe
      4⤵
      PID:632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38318.exe
      4⤵
      PID:8456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34310.exe
      4⤵
      PID:14616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42340.exe
      4⤵
      PID:16216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32479.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32479.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3581.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1189.exe
        5⤵
        
        PID:5812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23674.exe
        6⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48356.exe
        7⤵
        
        PID:14932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22467.exe
        7⤵
        
        PID:16080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51302.exe
        6⤵
        
        PID:9524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35865.exe
        6⤵
        
        PID:13552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42942.exe
        6⤵
        
        PID:16740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60615.exe
        6⤵
        
        PID:17320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50924.exe
        6⤵
        
        PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28936.exe
        5⤵
        
        PID:7032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1215.exe
        6⤵
        
        PID:6564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
        6⤵
        
        PID:14416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36501.exe
        6⤵
        
        PID:5820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11255.exe
        5⤵
        
        PID:9676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13306.exe
        5⤵
        
        PID:13156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52864.exe
        5⤵
        
        PID:16804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65335.exe
      4⤵
      PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48802.exe
        5⤵
        
        PID:6028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35542.exe
        5⤵
        
        PID:9992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42087.exe
        5⤵
        
        PID:13596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4623.exe
        5⤵
        
        PID:16880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26228.exe
        5⤵
        
        PID:7348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2791.exe
      4⤵
      PID:7736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51137.exe
      4⤵
      PID:8528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55980.exe
      4⤵
      PID:13508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20376.exe
      4⤵
      PID:16552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12865.exe
      4⤵
      PID:6228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64769.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64769.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54474.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24874.exe
        5⤵
        
        PID:7392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11407.exe
        6⤵
        
        PID:14088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44834.exe
        6⤵
        
        PID:7480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27260.exe
        5⤵
        
        PID:7876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42060.exe
        5⤵
        
        PID:12420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18358.exe
        5⤵
        
        PID:17316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48056.exe
        5⤵
        
        PID:5292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62761.exe
      4⤵
      PID:7668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59238.exe
        5⤵
        
        PID:14956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5722.exe
        5⤵
        
        PID:844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22571.exe
        5⤵
        
        PID:7560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
      4⤵
      PID:9404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64645.exe
      4⤵
      PID:13492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36911.exe
      4⤵
      PID:16540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8595.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8595.exe
    3⤵
    PID:5984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64261.exe
      4⤵
      PID:6572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46616.exe
      4⤵
      PID:10896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58589.exe
      4⤵
      PID:14144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42324.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42324.exe
    3⤵
    PID:7896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64766.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64766.exe
    3⤵
    PID:10796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59649.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59649.exe
    3⤵
    PID:13388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28258.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28258.exe
    3⤵
    PID:6160
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9398.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9398.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31812.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31812.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64650.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31148.exe
        5⤵
        
        PID:2152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2533.exe
        6⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61568.exe
        7⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55247.exe
        7⤵
        
        PID:11080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46502.exe
        7⤵
        
        PID:13224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe
        7⤵
        
        PID:6220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42854.exe
        6⤵
        
        PID:8652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33341.exe
        6⤵
        
        PID:12120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34799.exe
        6⤵
        
        PID:4100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42564.exe
        6⤵
        
        PID:17484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3280.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65242.exe
        6⤵
        
        PID:9168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7738.exe
        6⤵
        
        PID:11328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11883.exe
        6⤵
        
        PID:15192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47052.exe
        5⤵
        
        PID:8436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54828.exe
        5⤵
        
        PID:12236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17086.exe
        5⤵
        
        PID:15696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39352.exe
        5⤵
        
        PID:6448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17312.exe
      4⤵
      PID:384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12647.exe
        5⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3213.exe
        6⤵
        
        PID:9068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39834.exe
        6⤵
        
        PID:10540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23621.exe
        6⤵
        
        PID:15456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15034.exe
        5⤵
        
        PID:7056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9605.exe
        5⤵
        
        PID:11696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3802.exe
        5⤵
        
        PID:15532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42444.exe
        5⤵
        
        PID:1428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53964.exe
      4⤵
      PID:6672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27500.exe
        5⤵
        
        PID:3744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43893.exe
        5⤵
        
        PID:11576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36422.exe
        5⤵
        
        PID:3304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14022.exe
      4⤵
      PID:8484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-583.exe
      4⤵
      PID:11932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40630.exe
      4⤵
      PID:15752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28256.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28256.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29394.exe
      4⤵
      PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46472.exe
        5⤵
        
        PID:7152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57214.exe
        6⤵
        
        PID:11204
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7152 -s 648
        6⤵
        Program crash
        
        PID:13716
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5260 -s 660
        5⤵
        Program crash
        
        PID:9892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29512.exe
      4⤵
      PID:7180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23864.exe
        5⤵
        
        PID:15268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14981.exe
        5⤵
        
        PID:17604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9693.exe
      4⤵
      PID:10220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33535.exe
      4⤵
      PID:12352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3663.exe
      4⤵
      PID:17124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54598.exe
      4⤵
      PID:17524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48536.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48536.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44910.exe
      4⤵
      PID:6584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24462.exe
        5⤵
        
        PID:16504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8732.exe
        5⤵
        
        PID:15724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16683.exe
      4⤵
      PID:10144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9606.exe
      4⤵
      PID:13400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61608.exe
      4⤵
      PID:16456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9468.exe
      4⤵
      PID:2332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20493.exe
      4⤵
      PID:8032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41600.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41600.exe
    3⤵
    PID:6848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1816.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1816.exe
    3⤵
    PID:10244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22083.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22083.exe
    3⤵
    PID:13736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57135.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57135.exe
    3⤵
    PID:16548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3562.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3562.exe
    3⤵
    PID:5236
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53608.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53608.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31786.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31786.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13633.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57956.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15527.exe
        6⤵
        
        PID:7148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50203.exe
        6⤵
        
        PID:10324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9388.exe
        6⤵
        
        PID:14488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59828.exe
        6⤵
        
        PID:1132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11300.exe
        6⤵
        
        PID:7384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27504.exe
        5⤵
        
        PID:8016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57681.exe
        5⤵
        
        PID:11972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-531.exe
        5⤵
        
        PID:14644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20197.exe
        5⤵
        
        PID:15784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25044.exe
      4⤵
      PID:6356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27858.exe
        5⤵
        
        PID:10728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
        5⤵
        
        PID:1372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45708.exe
        5⤵
        
        PID:17724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54426.exe
      4⤵
      PID:9324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36519.exe
      4⤵
      PID:13976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15114.exe
      4⤵
      PID:4584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51982.exe
      4⤵
      PID:13716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18272.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18272.exe
    3⤵
    PID:5636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11661.exe
      4⤵
      PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12097.exe
        5⤵
        
        PID:10920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
        5⤵
        
        PID:14348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28333.exe
        5⤵
        
        PID:15788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44888.exe
      4⤵
      PID:9720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47925.exe
      4⤵
      PID:12560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5609.exe
      4⤵
      PID:17180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50579.exe
      4⤵
      PID:6644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7861.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7861.exe
    3⤵
    PID:6996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57214.exe
      4⤵
      PID:11252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32766.exe
      4⤵
      PID:13516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40585.exe
      4⤵
      PID:3120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9336.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9336.exe
    3⤵
    PID:10168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63956.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63956.exe
    3⤵
    PID:11904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52665.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52665.exe
    3⤵
    PID:17096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5569.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5569.exe
    3⤵
    PID:16488
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63497.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63497.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44360.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44360.exe
    3⤵
    PID:5328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42388.exe
      4⤵
      PID:3016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8423.exe
        5⤵
        
        PID:10056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45237.exe
        5⤵
        
        PID:13352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45934.exe
        5⤵
        
        PID:17344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38753.exe
        5⤵
        
        PID:1428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44888.exe
      4⤵
      PID:9476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47925.exe
      4⤵
      PID:12824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5609.exe
      4⤵
      PID:17160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3428.exe
      4⤵
      PID:8012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59663.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59663.exe
    3⤵
    PID:3792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3471.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3471.exe
    3⤵
    PID:10236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33535.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33535.exe
    3⤵
    PID:11416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3663.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3663.exe
    3⤵
    PID:17044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3900.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3900.exe
    3⤵
    PID:6884
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60464.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60464.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6015.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6015.exe
    3⤵
    PID:3284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18372.exe
      4⤵
      PID:8412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24458.exe
      4⤵
      PID:11868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59966.exe
      4⤵
      PID:15772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34363.exe
      4⤵
      PID:5728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3550.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3550.exe
    3⤵
    PID:3184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41292.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41292.exe
    3⤵
    PID:11988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27897.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27897.exe
    3⤵
    PID:15620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33858.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33858.exe
    3⤵
    PID:5712
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19447.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19447.exe
  2⤵
  PID:7224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7899.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7899.exe
    3⤵
    PID:15156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34719.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34719.exe
    3⤵
    PID:5484
- C:\Users\Admin\AppData\Local\Temp\Unicorn-978.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-978.exe
  2⤵
  PID:8972
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33460.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33460.exe
  2⤵
  PID:12652
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19329.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19329.exe
  2⤵
  PID:17056
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29192.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29192.exe
  2⤵
  PID:2460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2460 -ip 2460
1⤵
PID:3644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 5260 -ip 5260
1⤵
PID:9040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5564 -ip 5564
1⤵
PID:10340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 7152 -ip 7152
1⤵
PID:13608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 15860 -ip 15860
1⤵
PID:16456

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:4940

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:5620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-10841.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-10841.exe
Size 468KB
SHA256 24458c63718f69056c659c49adc4c180497a4c3df0693d73257348f480862c04
MD5 c1d56ca38940afa9e049ab78a2214939
SHA1 83d1be549b158fbc4361c4b4ac5e635fa51797ca
SHA512 a1da904316fe05398cd55666183c630d44b8cefcc3273833148f8671ece85295eeeaa793d5da7521ebc3322229b84ed0c2f1570dd6f78ee4493b3226cf0338f4
SSDEEP 3072:6Ij4ovI7Ug5/jYYUPga7Of8y354D1fXMx8HxRH++Sd0Verwe8glo:6I0oPQ/juPH7OfOPd/SdMgwe8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-11946.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-11946.exe
Size 468KB
SHA256 6bfcac6d3f39427cc4c47c62c970d9f4a3578bbe4a7948177652de1f307dffa8
MD5 67fcffb4d633e9bc20e9fdcd3e1671e0
SHA1 ff2fb87b8dd51effc0c7cec0ba0897e736a42772
SHA512 c0501e756c4f9102fade5b07495ec83f7df43f937af704e522df772423dda10914fce8d54987c90af0c99c30a254fffb6f1a6da9f9f5e772ee3d204f30cb69c7
SSDEEP 3072:6Ij4ovI7Ug5OjYYUPga7Of8y354D1fXMx8HxRH++Sd0Verwe8glo:6I0oPQOjuPH7OfOPd/SdMgwe8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-16166.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-16166.exe
Size 468KB
SHA256 3439c0da9c79048b2d2fb8a589bab371936cf9ba8788545dd5d95f2bf79fd804
MD5 703bfec4e8b3b0489a5de46bd5841123
SHA1 1d41364c4d7e88554393f2781d691531f21860f5
SHA512 65c77594eaca66a3794215a47dd9883c99bf1fdb35bfc5a1a39c0d44731f01e566b1009bb9ef7c6845ed46de4c277bf0b9a29c9cc4642dde5be7d6b4c676c9b3
SSDEEP 3072:6Ij4ovIwUg5/jYYUPga7Of8y354D1fXMx8HxRHX+Sd0Verwe8glo:6I0oIQ/juPH7OfOPdUSdMgwe8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-17422.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-17422.exe
Size 468KB
SHA256 192a6ba9fbe5a10847da012de04d6380836a9fa9f200ab307d416ebfa9143aa2
MD5 ed44e02c3282053f1b45c9e1247412b1
SHA1 9ec49de75de207418bf86194ae4755725df15cdf
SHA512 ce29035c10f90487c4854368c96d7067cf91f706ec32b0aab77de4fca03e508d3aa8a4dd827f5a80fccf67d18ebe1c7145b6d1e0d457fd5b0cac8a9f7b54f627
SSDEEP 3072:6Ij4ovI7Ug5/jYYUPga7wf8y354D1fXMx8HxRH++Sd0Verwe+glo:6I0oPQ/juPH7wfOPd/SdMgwe+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-17618.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-17618.exe
Size 468KB
SHA256 05fceb3e4ffa227d53f2129fc089995258fb0359068a4a9a9846ed1ee329756c
MD5 ecbe30045d250e47bc9e8841a2e6a697
SHA1 dcbee6519d92b689681732eb3e655e62e48bba6b
SHA512 ab7ece2535c11b1afd6455b8b6b354c67b445cd495ab655c3e6190304537833a6e4b1bc7f595e3ec11ade55636ea7f8a98c433c936eff2c0fd9ba3cafb479ede
SSDEEP 3072:6Ij4ovIwUg5/jYYUPga7Of8y354D1fXMx8HxRHX+Sd0Verwe8glo:6I0oIQ/juPH7OfOPdUSdMgwe8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-22226.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-22226.exe
Size 468KB
SHA256 fd7b459e96201f6789844d688ce173a755fcc1b1c7dcf7939dc261a4e0b68526
MD5 638aa6b1279fc3426e5f227cf2d20896
SHA1 c4c6b958b674b8c036eb502e9bd250e99b99ffb4
SHA512 47c23c8d6810eda0ec2705e1207697a4fd1d7003bdff730431a66036d2f3d42ad5743bb22133bf5f6c1ad9cc98801136bd08d9db3042eadedf84114ebe243989
SSDEEP 3072:6Ij4ovI7Ug5/jYYUPga7Of8y354D1fXMx8HxRH++Sd0VerZe+glo:6I0oPQ/juPH7OfOPd/SdMgZe+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-25681.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
Size 468KB
SHA256 4adadd5c1318f218710dfd4dbf7d8c335797c64da75bcc6369c2ec16c2e709bf
MD5 275b970c32886ec5b69ea63f91d18396
SHA1 d0f5b8624a4b651f3cb152b7e26e267bfc2ebc0d
SHA512 1ff90bbdb3b4596a16fbcb3c21d8a790710c5874ec0d58bbf1ab1a17f1a5e755cf26443de96f9d7717751f98f8e88d71216c215e569ed08f3d1f80246ef0ce32
SSDEEP 3072:6Ij4ovIwUg5/jYYUPgS7Of8y3s4D1fXMx8HxRHX+pd0Verwe8glo:6I0oIQ/juPf7OfpPdUpdMgwe8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-25782.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-25782.exe
Size 468KB
SHA256 4acc2f8ab243abb577a5512dfc98ec0d1f9754709f27434b4fb71b90ab072675
MD5 b781b1100989c60867ecbf37c36fc709
SHA1 165d3898fd316ba58d39e44da00662c8bdc45b43
SHA512 cbe1b5ca53baf70070eb1cc55978b3f8c4f4d8324a5621d3e28b5fb99deb40c7a45bd60dde51d5379ddaf327c39539bd1e5697a4f4b39ba088cb8e3685e0381e
SSDEEP 3072:6Ij4ovIwUg5/jYYUPga7Of8y354D1fXMx8HxWHX+Sd0Verwe8mlo:6I0oIQ/juPH7OfOPdpSdMgwe8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-27126.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-27126.exe
Size 468KB
SHA256 b4117d9eab08363b137de054131447cfd46060e354162ddcfdda1c3fab2752c3
MD5 d3ae840b9d74677aec27a000b80df44f
SHA1 0c43a877b8b32957c2708fe208d0a409e56cbd81
SHA512 5cdcfd4afe226236f82f627203da1777e483aee4b0feec86ee8f347444335c1cc904239277892879a9fecc70cf97535856a7a10abd5f6f614ed0f6ddda039119
SSDEEP 3072:6Ij4ovIwUg5/jYYUPga7Of8y354D1fXMx8HxWHW+Sd0Verwe8mlo:6I0oIQ/juPH7OfOPdGSdMgwe8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-27432.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-27432.exe
Size 468KB
SHA256 e6f57d6742c13e78d28a7821d77ab1d87d0c10d89df46d53b43e3d5323a25f54
MD5 819fbda7bb874f35bbd89f295daaa233
SHA1 0afedd1c35a0697db73090de9c5a6f5e9bd040ab
SHA512 a21687e472d773e19f1671ad37ed176995c157e3310c0b0a1f6cd2bf51b90cd8e56b50dc149784d99a4615e11cf3f39ba5030560919129bbb52278116b72fd3d
SSDEEP 3072:6Ij4ovIwUg5/jYYUPga7Of8y354D1fXMx8HxRH++Sd0Verwe8glo:6I0oIQ/juPH7OfOPd/SdMgwe8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-27728.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-27728.exe
Size 468KB
SHA256 8bcffdcc95a49bee1e57e60f8c31d8f0e8312ba5ff9315b24888389813cdf00d
MD5 318d10fbcf480ced24416728452868ee
SHA1 f403a2fcd5f67ee4b5bd7efbe9cfd3543f74c727
SHA512 6c96fe8819543643b3b2c5595caaa6a2435ccde9891590ad67c214a3ae778791ec3bc6ce84353fd946a39c5eb7d2efa7f28525cdf4a4d0d5151ebf0c5709e1ef
SSDEEP 3072:6Ij4ovIwUg5/jYYUPga7Of8y354S1fXMx8HxRHy+Sd0Verwe8glo:6I0oIQ/juPH7OfvPdjSdMgwe8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-31812.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-31812.exe
Size 468KB
SHA256 838cde691d2e9ce7b292c2ceb19b1b8549af30a12cb0a8ef6ffb7b001d65b61d
MD5 b7e0f1877a1a33268d2e3c6f8997922e
SHA1 33b7d8c53e90929dc69336eab8833ba767ac4887
SHA512 488a2266e95f833956ea0d0d2d87f2d4c52ad386bdd475b7055636ba99fed151db35235c21d3ab91e3cc38a2d75ab226c5bceabb8bb51341abcc5842abe62eb9
SSDEEP 3072:6Ij4ovIwUg5/jYYUPgS7Of8y354D1fXMx8HxRHXLSd0Verwe8glY:6I0oIQ/juPf7OfOPdhSdMgwe8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-32479.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-32479.exe
Size 468KB
SHA256 8876dfa5ba0b05dd62500afe5e533fb0504bcbf3ae8ceaf34b2bffc81cd26032
MD5 d43b89bfa8a504fc5ef0418a145de404
SHA1 32b0546d684fa55e9a98804248b90106e36867ef
SHA512 899f947f7c7608d07e468514f5b6ab563768238e67799b8c81ab95b9a6ce306250ede4b9973770d572a8d617e21b97279d692f616ef700a6a964674370932026
SSDEEP 3072:6Ij4ovIwUg5/jYYUPgS7Of8y354D1fXMx8Hx1HX+Sd0Verwe8gl+:6I0oIQ/juPf7OfOPdASdMgwe8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-3482.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-3482.exe
Size 468KB
SHA256 0bc95d1cbdf66f28fbc00c622b8b26991ed60747ca601b60a9abf4546a5a4879
MD5 3f17a93dda8ea48037b9b199803bfabd
SHA1 f0ee9a660fd24c708cb53860f989b213c632bfcd
SHA512 5fc89036ea401a35d3fc28401cba3c720af10f7513cd2d6b6b76c1026b0bdd64775321041bbe789d00be4870b4df122df9bcfb0ab7c70c183e30fec8bc775927
SSDEEP 3072:6Ij4ovIwUg5/jYYUPgS7Of8y354D1fXMx8HxRHX+pd0Verwe8glo:6I0oIQ/juPf7OfOPdUpdMgwe8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-3533.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-3533.exe
Size 468KB
SHA256 5649c127fb1eda74be9612084445d8b369a5832a861d5e38c7729b7a59198c8d
MD5 a2a47b1b95560e3522a1deeed363bd20
SHA1 8e9f7e0773d0ebb57d1134b1b11e9f04d2cef018
SHA512 78e31a2149131085dc627e14574ada2420243a92d26a5f14c93d2e667066e4e7e78e34c3f25156b68f0a56b391c0a708551a9aa398819fc705a5b86022a9dd46
SSDEEP 3072:6Ij4ovIwUg5/jYYUPga7Of8y354D1fXMx8HxRHX+Sd0Verwe8g7o:6I0oIQ/juPH7OfOPdUSdMgwe8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-42288.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42288.exe
Size 468KB
SHA256 744be88559450f2b8dbe188d68fd0168b61e50eeeb21929defcde70d0c45bf56
MD5 b9101b63506809039d6752c67494df97
SHA1 1f5d364a0acb5f6458e553c2d2a5a87e0bc3cd26
SHA512 9960b616238074a02ec2f571c11595ceb27afaaedfdc5ea9be378e4f6ede563c3c35439911d485125853d33c4961e083ae1a63f1545440a0500eee2b49316961
SSDEEP 3072:6Id4ovIwUg5/jYYUPgS7Of8y354D1fXMx8HxRHX+Sd0Verwe8gl+:6ICoIQ/juPf7OfOPdUSdMgwe8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-42694.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42694.exe
Size 468KB
SHA256 bb0d3ee8fb52d8c6f967c310fc09a9ce6f0768df4cc34645e4f4abb1e08be32c
MD5 17a5d5ec000e9ee931908686c4a894db
SHA1 0b1fe04032deb2be60997ec763f604c191a866f8
SHA512 5dbc2c100eeaeb726366045a47fb1e8fb84c7cf2477c8d9132ab42b85dad1354f10009ddcd540dfaded721042395e8ead71131a90dac9fb34ca0c1d71330e1c4
SSDEEP 3072:6Id4ovIwUg5/jYYUPgS7Of8y354D1fXMx8HxRHX+SdEVerwe8gl+:6ICoIQ/juPf7OfOPdUSdcgwe8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-45652.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-45652.exe
Size 468KB
SHA256 dc583123c4df2f518c801a1b40f5dee6f792c9d22e457ba0c1f2b0c6293378d7
MD5 d7deffe589e50cddfc5781dd90f1480c
SHA1 938db807d89337c62b7304cae1484f4604e3f327
SHA512 f1f3fa3df626c14db8caa2bf09edca4d1584e0fa065bdbe1f6d6f9f9502d9ed20b63fca6856444ddb3bf6f3a8959ba2a11ff2159ccc550fed7682f0002d9d3e9
SSDEEP 3072:6Ij4ovIwUg5/jYYUPgS7Of8y354D1fXMx8HxRHX+pd0VUrwe8glo:6I0oIQ/juPf7OfOPdUpdMiwe8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-4711.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-4711.exe
Size 468KB
SHA256 2c7014c67378957487e1db93c849a92d928a5625197aed461ab55776c7cb9763
MD5 1a77047d2693e7f9b09bc5259bceb3b0
SHA1 c6e769c957b84d2518a86ad9e3efe7dc7b681a1d
SHA512 eac5b48b3aa51f5637f6355b9f7489bc92624044b743540fdc50aa4767d9f869ca30ecbff9b195371ff1d1d6fcc1f512c55c0cad4948d2e7a80ae0353e63f933
SSDEEP 3072:6Ij4ovIwUg5/jYYUPgS7Of8y354D1fXMx8HxRHX+Sd0Verwe8gl+:6I0oIQ/juPf7OfOPdUSdMgwe8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-483.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-483.exe
Size 468KB
SHA256 099927149c8c790309c14fdc8e8900d547ef061ef7eb8da023e94e308136b3a1
MD5 012bdd65e62f675007e9c29d15952e08
SHA1 6e17a052c55b39e1bcb9e8eedefd77be19294026
SHA512 8233e75f86618bc2016b46d17199a6fc110e7d37e83c1c1e82af9b0f35a1dbe5a07c7f50e69e1a440bb64c9bf08b20e1f68f7f9364834ca50ec6c9ce657904e4
SSDEEP 3072:6Ij4ovI7Ug5/jYYUPga7wf8y354D1fXMx8HxRH++Sd0Verwe+gl0:6I0oPQ/juPH7wfOPd/SdMgwe+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-52324.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-52324.exe
Size 468KB
SHA256 bec237a04725fc66633fb28a4cc8c51c972e77aabbecc8dea323e37eef2cfc1c
MD5 30d03fbd0e5fec812109973ace039315
SHA1 90ff9f01586763411bf51e639578caa6c1a4cd7e
SHA512 b15e7664d836c92ab8a2c30ca59316725b33db08eace2329beb6a9ee4673c29fb9151fecdc5614af42edef022edd13a5ac1968a204b8fbe07a8a55a3d5436379
SSDEEP 3072:6Ij4ovIwUg5/jYYUPga7Of8y354D1fXMx8HxRH++Sd0Vkrwe8glo:6I0oIQ/juPH7OfOPd/SdMSwe8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-53608.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-53608.exe
Size 468KB
SHA256 6fc834b9824048402e148da056598502f2cf11aeb9d0d001420d9912229ce7a3
MD5 86ff39add571f3a7bed44e631ed37571
SHA1 65af8cf005e4ccc7220702c9a99121da151e7b81
SHA512 6a2261929690f97a531929b42ef9c6319c5d285b404ba3f64541cd874403e3f9ae940ac3019ef177cf4f207bd7d21cd8848b0994cc1ebd6d812c384281d9ec1f
SSDEEP 3072:6Ij4ovIwUg5/jYYUPgS7Of8y354D1fXMx8HxRHX+Sd0Verwe2glo:6I0oIQ/juPf7OfOPdUSdMgwe2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-55335.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-55335.exe
Size 468KB
SHA256 70e352de1a9bf6b12bdaa0df09771d6ff072d7f47d2013ee1253b69dab223cc0
MD5 63850b5ae09e59ddcea18737fc29af24
SHA1 19fefaa07c811aa46c7247bbc0ecf94f0aa1bebc
SHA512 496ffb0bc014d2c042b7ece59df955978053e9d5e281b989a4a7967336aa028fa1e8914e1a97550856524acb529b6f1acaca1fcffb68ebc8591dfad9e4c39554
SSDEEP 3072:6Ij4ovIwUg5/jYYUPga7Of8y354S1fXMx8HxRH++Sd0Verwe8glo:6I0oIQ/juPH7OfvPd/SdMgwe8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-56918.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-56918.exe
Size 468KB
SHA256 57b4baf258e2ffed166bc19a738510cfe45356a9c40bda80a8d0ff3bf11b9806
MD5 e94ca45cf3acc346dda1425199408c15
SHA1 4c9be438802b7dd641caf1a1fb0b861a78e5ce90
SHA512 4b64ba1befcdab599cc1771465bee8f8d9e2aa59417e27f0c3d2f537bb64858fec3f6737daaedc4418cc214eeb6d37212f2a3dd1c0a9bc0831f06b0d8c8d1a05
SSDEEP 3072:6Ij4ovI7Ug5/jYYUPga7Of8y354D1fXMx8HxRH++Sd0Verwe+glo:6I0oPQ/juPH7OfOPd/SdMgwe+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-57176.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-57176.exe
Size 468KB
SHA256 811f8adb898c6b19f5f93d99a229482c91931c8c0c68093fc7749cb00cc6f03c
MD5 1345bd2fa22ca8d4046b7799e87fcbbd
SHA1 d88225843c7520765fe8faaefeefd536b65b5617
SHA512 46210094459a0ff03261662707976b558c0644e1378697abc445a4e4185bb58824bda773f02201b63dd2dfc73bb7cc20f36448a65f8d39544f7d8ead938eba51
SSDEEP 3072:6Ij4ovIwUg5/jYYUPgS7Of8y354D1fXMx8HxRHX+pd0VUUwe8glo:6I0oIQ/juPf7OfOPdUpdMJwe8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-58189.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-58189.exe
Size 468KB
SHA256 9d703922f7af0f80ad0eada85de0b0231c731cb8f285590331d3498f8cc377c7
MD5 8c286ebe642ba974fd2f1e78eb2feccb
SHA1 eee3ad35c0f938b200ef78b6dc5b4c1229ae18b8
SHA512 d90ae97c32bb2e8976f183a965394797cd4e516b366474f4bedd722f0b2b7cdd690dc30949ac944ceef19325ef2146a908368da90cf23bb18cc779bd1e60f10f
SSDEEP 3072:6Ij4ovIwog5/jYYUPga7Of8y354D1fXMx8HxRHX+Sd0Verwe8glo:6I0o0Q/juPH7OfOPdUSdMgwe8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-61002.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-61002.exe
Size 468KB
SHA256 8bf1eefc6da379d2d0b2578888b9bc15a085047c2947d6f97838c17c01aef8b2
MD5 55238b842c94424beca978a37d079cdf
SHA1 53440179afae49e0b538cc9245738312fec8bfb6
SHA512 be7376a51e36012cbe16a660bf5b30d752b775498601038d8e2c6eab7e4adbac931d084b8fbeec1c48f6ea2a0456c5a16943c7b639c29b5ff427f1c273cf4ae2
SSDEEP 3072:6Ij4ovIwUg5/jYYUPga7Of8y354D1fXMx8HxRHX+Sd0Verwe8mlo:6I0oIQ/juPH7OfOPdUSdMgwe8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-63093.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-63093.exe
Size 468KB
SHA256 ccf75e42ba9111f625125bd0cd9c04b2121d6f23ce09672ec2f0bae98cb03b30
MD5 5e534ce63b978bab2fd60260f559acb4
SHA1 02d13a5ef32c8a16a0001ebc3d3be0a4543dd8e8
SHA512 33191a34e609ceb22e621720dc896854640ad09c3686675053e6bc5077a847dd709d62fa759846349709c58fb00e6c28ebba6fb3809649726f1ddc86ef337994
SSDEEP 3072:6Ij4ovIwUg5/jYYUPga7Of8y354D1fXMx8HxRHXYSd0Verwe8glo:6I0oIQ/juPH7OfOPdqSdMgwe8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-9398.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-9398.exe
Size 468KB
SHA256 851c403f4361a87e4f2b1c6f967e60021fefad34ce32e36c91b15672e6223864
MD5 21f967defc01011460d6f01504aa8e63
SHA1 f98ecd07b9a58e9b09cefba97db9b84e54b4fac4
SHA512 2b20b06d6a69cbe4d3dae755fe2d45ae1b4a4c2041a311f3e351da360f2adb31728e836872adc17d93d36b524af57a1164b294e0012cae16d3a39f5d6fbc69e0
SSDEEP 3072:6Ij4ovIwUg5/jYYUPgS7Of8y354D1fXMx8HxRHXLSd0Verwe8glo:6I0oIQ/juPf7OfOPdhSdMgwe8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2676-2778-0x0000000074DE0000-0x0000000074DF6000-memory.dmp

Download

memory/16456-2779-0x0000000075120000-0x00000000751B6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads