3372667e868eef54f003476b83949bef47f8b568ee3eed15e0738638dd96810d

Analysis

max time kernel
120s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2024, 22:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3372667e868eef54f003476b83949bef47f8b568ee3eed15e0738638dd96810dN.exe
Size 468KB
Sample241109-2wpqmstgnm
SHA256 3372667e868eef54f003476b83949bef47f8b568ee3eed15e0738638dd96810d
MD5 30d5af5191f88a6f09efc95b0cb411d0
SHA1 08d80123e45c4a35f2213acc07233148c5590bea
SHA512 396858b7f38b55e7c2ef05a6b1e0ac0f87f5ad1418b53b30eec6131593c1dd4d9a951566c23e93a7a90c5d3952557eeab5d1bb2928b8d611ab629e3d035aa614
SSDEEP 3072:OTGcogzda88Un+/hP55FTo5K4ezWI8JEQHe5Vm/2xg3Df3QL8lP:OTVoVRUniPfFToxxCc2xeD3QL
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2308	Unicorn-49887.exe
3524	Unicorn-49441.exe
1160	Unicorn-33659.exe
1380	Unicorn-23759.exe
4080	Unicorn-36011.exe
4368	Unicorn-29880.exe
3996	Unicorn-16145.exe
2792	Unicorn-60105.exe
4940	Unicorn-35693.exe
2332	Unicorn-41823.exe
4944	Unicorn-45907.exe
1060	Unicorn-15180.exe
3876	Unicorn-38293.exe
768	Unicorn-53810.exe
2796	Unicorn-34209.exe
3360	Unicorn-59311.exe
4928	Unicorn-11241.exe
4420	Unicorn-52103.exe
3220	Unicorn-29545.exe
3240	Unicorn-41532.exe
3428	Unicorn-21931.exe
1360	Unicorn-14962.exe
1076	Unicorn-27215.exe
208	Unicorn-57179.exe
3384	Unicorn-572.exe
3148	Unicorn-19601.exe
1588	Unicorn-43743.exe
4992	Unicorn-41697.exe
4072	Unicorn-43743.exe
5008	Unicorn-23222.exe
2060	Unicorn-9487.exe
232	Unicorn-19971.exe
540	Unicorn-38999.exe
3044	Unicorn-52835.exe
2320	Unicorn-20062.exe
3656	Unicorn-21123.exe
3036	Unicorn-23623.exe
2812	Unicorn-49711.exe
3544	Unicorn-3224.exe
920	Unicorn-54371.exe
2644	Unicorn-54371.exe
1152	Unicorn-46566.exe
1784	Unicorn-17231.exe
5084	Unicorn-3032.exe
392	Unicorn-13722.exe
2392	Unicorn-13722.exe
2356	Unicorn-13722.exe
4004	Unicorn-18553.exe
432	Unicorn-50671.exe
60	Unicorn-54755.exe
4856	Unicorn-38419.exe
64	Unicorn-43057.exe
3488	Unicorn-46587.exe
4744	Unicorn-60685.exe
5104	Unicorn-37656.exe
4476	Unicorn-50671.exe
4860	Unicorn-50671.exe
1976	Unicorn-44541.exe
2396	Unicorn-5097.exe
2564	Unicorn-49517.exe
872	Unicorn-13265.exe
1836	Unicorn-17349.exe
1520	Unicorn-11484.exe
2912	Unicorn-55118.exe

Program crash 9 IoCs

pid	pid_target	Process	procid_target
552	3220	WerFault.exe	116
7536	6140	WerFault.exe	204
7708	5068	WerFault.exe	165
7780	4412	WerFault.exe	164
9908	5804	WerFault.exe	218
12852	2756	WerFault.exe	212
13228	6032	WerFault.exe	230
16208	13688	WerFault.exe	684
15388	14056	WerFault.exe	704

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5850.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6670.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53817.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52612.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51989.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58341.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28798.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54811.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55679.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38777.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9192.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60588.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21459.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13722.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10261.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4127.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54811.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23996.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21885.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44641.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61339.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-314.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44669.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42881.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43265.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44937.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8517.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37589.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13412.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27215.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19971.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36198.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29639.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51356.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50801.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60449.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49887.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59576.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29452.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30882.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14293.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12530.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15429.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43317.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23981.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56696.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45579.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15180.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46587.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17683.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37209.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42881.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57001.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54371.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44669.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2254.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2440	3372667e868eef54f003476b83949bef47f8b568ee3eed15e0738638dd96810dN.exe
2308	Unicorn-49887.exe
3524	Unicorn-49441.exe
1160	Unicorn-33659.exe
1380	Unicorn-23759.exe
3996	Unicorn-16145.exe
4368	Unicorn-29880.exe
4080	Unicorn-36011.exe
2792	Unicorn-60105.exe
2332	Unicorn-41823.exe
1060	Unicorn-15180.exe
4940	Unicorn-35693.exe
4944	Unicorn-45907.exe
768	Unicorn-53810.exe
2796	Unicorn-34209.exe
3876	Unicorn-38293.exe
3360	Unicorn-59311.exe
4928	Unicorn-11241.exe
4420	Unicorn-52103.exe
3428	Unicorn-21931.exe
1076	Unicorn-27215.exe
3240	Unicorn-41532.exe
1360	Unicorn-14962.exe
4992	Unicorn-41697.exe
1588	Unicorn-43743.exe
208	Unicorn-57179.exe
5008	Unicorn-23222.exe
3384	Unicorn-572.exe
3148	Unicorn-19601.exe
4072	Unicorn-43743.exe
232	Unicorn-19971.exe
540	Unicorn-38999.exe
2060	Unicorn-9487.exe
3044	Unicorn-52835.exe
2320	Unicorn-20062.exe
3656	Unicorn-21123.exe
3036	Unicorn-23623.exe
2812	Unicorn-49711.exe
3544	Unicorn-3224.exe
920	Unicorn-54371.exe
1152	Unicorn-46566.exe
2644	Unicorn-54371.exe
1784	Unicorn-17231.exe
5084	Unicorn-3032.exe
2392	Unicorn-13722.exe
2356	Unicorn-13722.exe
392	Unicorn-13722.exe
432	Unicorn-50671.exe
4004	Unicorn-18553.exe
4744	Unicorn-60685.exe
2912	Unicorn-55118.exe
1520	Unicorn-11484.exe
1836	Unicorn-17349.exe
2564	Unicorn-49517.exe
4856	Unicorn-38419.exe
5104	Unicorn-37656.exe
3488	Unicorn-46587.exe
60	Unicorn-54755.exe
2396	Unicorn-5097.exe
4412	Unicorn-63286.exe
64	Unicorn-43057.exe
872	Unicorn-13265.exe
4476	Unicorn-50671.exe
1976	Unicorn-44541.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2308	2440	3372667e868eef54f003476b83949bef47f8b568ee3eed15e0738638dd96810dN.exe	89
PID 2440 wrote to memory of 2308	2440	3372667e868eef54f003476b83949bef47f8b568ee3eed15e0738638dd96810dN.exe	89
PID 2440 wrote to memory of 2308	2440	3372667e868eef54f003476b83949bef47f8b568ee3eed15e0738638dd96810dN.exe	89
PID 2308 wrote to memory of 3524	2308	Unicorn-49887.exe	94
PID 2308 wrote to memory of 3524	2308	Unicorn-49887.exe	94
PID 2308 wrote to memory of 3524	2308	Unicorn-49887.exe	94
PID 2440 wrote to memory of 1160	2440	3372667e868eef54f003476b83949bef47f8b568ee3eed15e0738638dd96810dN.exe	96
PID 2440 wrote to memory of 1160	2440	3372667e868eef54f003476b83949bef47f8b568ee3eed15e0738638dd96810dN.exe	96
PID 2440 wrote to memory of 1160	2440	3372667e868eef54f003476b83949bef47f8b568ee3eed15e0738638dd96810dN.exe	96
PID 3524 wrote to memory of 1380	3524	Unicorn-49441.exe	101
PID 3524 wrote to memory of 1380	3524	Unicorn-49441.exe	101
PID 3524 wrote to memory of 1380	3524	Unicorn-49441.exe	101
PID 1160 wrote to memory of 4080	1160	Unicorn-33659.exe	103
PID 1160 wrote to memory of 4080	1160	Unicorn-33659.exe	103
PID 1160 wrote to memory of 4080	1160	Unicorn-33659.exe	103
PID 2440 wrote to memory of 4368	2440	3372667e868eef54f003476b83949bef47f8b568ee3eed15e0738638dd96810dN.exe	104
PID 2440 wrote to memory of 4368	2440	3372667e868eef54f003476b83949bef47f8b568ee3eed15e0738638dd96810dN.exe	104
PID 2440 wrote to memory of 4368	2440	3372667e868eef54f003476b83949bef47f8b568ee3eed15e0738638dd96810dN.exe	104
PID 2308 wrote to memory of 3996	2308	Unicorn-49887.exe	102
PID 2308 wrote to memory of 3996	2308	Unicorn-49887.exe	102
PID 2308 wrote to memory of 3996	2308	Unicorn-49887.exe	102
PID 3996 wrote to memory of 2792	3996	Unicorn-16145.exe	105
PID 3996 wrote to memory of 2792	3996	Unicorn-16145.exe	105
PID 3996 wrote to memory of 2792	3996	Unicorn-16145.exe	105
PID 2308 wrote to memory of 4940	2308	Unicorn-49887.exe	107
PID 2308 wrote to memory of 4940	2308	Unicorn-49887.exe	107
PID 2308 wrote to memory of 4940	2308	Unicorn-49887.exe	107
PID 4368 wrote to memory of 2332	4368	Unicorn-29880.exe	106
PID 4368 wrote to memory of 2332	4368	Unicorn-29880.exe	106
PID 4368 wrote to memory of 2332	4368	Unicorn-29880.exe	106
PID 4080 wrote to memory of 4944	4080	Unicorn-36011.exe	108
PID 4080 wrote to memory of 4944	4080	Unicorn-36011.exe	108
PID 4080 wrote to memory of 4944	4080	Unicorn-36011.exe	108
PID 1380 wrote to memory of 1060	1380	Unicorn-23759.exe	109
PID 1380 wrote to memory of 1060	1380	Unicorn-23759.exe	109
PID 1380 wrote to memory of 1060	1380	Unicorn-23759.exe	109
PID 1160 wrote to memory of 2796	1160	Unicorn-33659.exe	111
PID 1160 wrote to memory of 2796	1160	Unicorn-33659.exe	111
PID 1160 wrote to memory of 2796	1160	Unicorn-33659.exe	111
PID 3524 wrote to memory of 3876	3524	Unicorn-49441.exe	112
PID 3524 wrote to memory of 3876	3524	Unicorn-49441.exe	112
PID 3524 wrote to memory of 3876	3524	Unicorn-49441.exe	112
PID 2440 wrote to memory of 768	2440	3372667e868eef54f003476b83949bef47f8b568ee3eed15e0738638dd96810dN.exe	110
PID 2440 wrote to memory of 768	2440	3372667e868eef54f003476b83949bef47f8b568ee3eed15e0738638dd96810dN.exe	110
PID 2440 wrote to memory of 768	2440	3372667e868eef54f003476b83949bef47f8b568ee3eed15e0738638dd96810dN.exe	110
PID 2792 wrote to memory of 3360	2792	Unicorn-60105.exe	113
PID 2792 wrote to memory of 3360	2792	Unicorn-60105.exe	113
PID 2792 wrote to memory of 3360	2792	Unicorn-60105.exe	113
PID 3996 wrote to memory of 4928	3996	Unicorn-16145.exe	114
PID 3996 wrote to memory of 4928	3996	Unicorn-16145.exe	114
PID 3996 wrote to memory of 4928	3996	Unicorn-16145.exe	114
PID 1060 wrote to memory of 4420	1060	Unicorn-15180.exe	115
PID 1060 wrote to memory of 4420	1060	Unicorn-15180.exe	115
PID 1060 wrote to memory of 4420	1060	Unicorn-15180.exe	115
PID 4940 wrote to memory of 3220	4940	Unicorn-35693.exe	116
PID 4940 wrote to memory of 3220	4940	Unicorn-35693.exe	116
PID 4940 wrote to memory of 3220	4940	Unicorn-35693.exe	116
PID 1380 wrote to memory of 3428	1380	Unicorn-23759.exe	119
PID 1380 wrote to memory of 3428	1380	Unicorn-23759.exe	119
PID 1380 wrote to memory of 3428	1380	Unicorn-23759.exe	119
PID 2308 wrote to memory of 3240	2308	Unicorn-49887.exe	120
PID 2308 wrote to memory of 3240	2308	Unicorn-49887.exe	120
PID 2308 wrote to memory of 3240	2308	Unicorn-49887.exe	120
PID 768 wrote to memory of 1360	768	Unicorn-53810.exe	121

C:\Users\Admin\AppData\Local\Temp\3372667e868eef54f003476b83949bef47f8b568ee3eed15e0738638dd96810dN.exe
"C:\Users\Admin\AppData\Local\Temp\3372667e868eef54f003476b83949bef47f8b568ee3eed15e0738638dd96810dN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49887.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49887.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49441.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49441.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23759.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15180.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52103.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21123.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44641.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29047.exe
        9⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6140 -s 636
        10⤵
        Program crash
        
        PID:7536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45248.exe
        9⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56447.exe
        10⤵
        
        PID:10288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42881.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:13736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35927.exe
        9⤵
        
        PID:10368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58861.exe
        9⤵
        
        PID:13856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44724.exe
        8⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47703.exe
        9⤵
        
        PID:10000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45809.exe
        10⤵
        
        PID:14456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        9⤵
        
        PID:7364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13996.exe
        8⤵
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51647.exe
        9⤵
        
        PID:13908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30900.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37027.exe
        7⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10126.exe
        8⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51211.exe
        9⤵
        
        PID:9644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-697.exe
        9⤵
        
        PID:11056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16597.exe
        8⤵
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8839.exe
        8⤵
        
        PID:12408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39959.exe
        7⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63655.exe
        8⤵
        
        PID:9376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54003.exe
        9⤵
        
        PID:10704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26571.exe
        8⤵
        
        PID:12652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28798.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36923.exe
        7⤵
        
        PID:12312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14596.exe
        7⤵
        
        PID:15852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23623.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54947.exe
        7⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21263.exe
        8⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe
        9⤵
        
        PID:9052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35311.exe
        10⤵
        
        PID:14260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9057.exe
        9⤵
        
        PID:13240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17967.exe
        8⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23996.exe
        8⤵
        
        PID:10476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48606.exe
        8⤵
        
        PID:15032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62020.exe
        7⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6670.exe
        8⤵
        
        PID:9828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12036.exe
        9⤵
        
        PID:11532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22103.exe
        8⤵
        
        PID:11572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23918.exe
        7⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30900.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63068.exe
        7⤵
        
        PID:15884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35002.exe
        6⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5850.exe
        7⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37589.exe
        8⤵
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52612.exe
        8⤵
        
        PID:12772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22819.exe
        7⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16212.exe
        7⤵
        
        PID:11304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46660.exe
        7⤵
        
        PID:15276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16136.exe
        6⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13276.exe
        7⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42881.exe
        7⤵
        
        PID:13792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11547.exe
        6⤵
        
        PID:9320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1486.exe
        7⤵
        
        PID:14056
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14056 -s 436
        8⤵
        Program crash
        
        PID:15388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41737.exe
        6⤵
        
        PID:9776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21931.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54371.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21673.exe
        7⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54065.exe
        8⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25721.exe
        9⤵
        
        PID:10316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42881.exe
        9⤵
        
        PID:13748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1605.exe
        8⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56067.exe
        8⤵
        
        PID:12156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49182.exe
        8⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29321.exe
        7⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60531.exe
        8⤵
        
        PID:10436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8376.exe
        8⤵
        
        PID:14020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30882.exe
        7⤵
        
        PID:9328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49872.exe
        7⤵
        
        PID:8052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33685.exe
        6⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43733.exe
        7⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37205.exe
        8⤵
        
        PID:9344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21885.exe
        8⤵
        
        PID:12896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9171.exe
        7⤵
        
        PID:9976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28632.exe
        7⤵
        
        PID:13820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50396.exe
        6⤵
        
        PID:8224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26759.exe
        7⤵
        
        PID:14276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44139.exe
        6⤵
        
        PID:3580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21459.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44541.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22165.exe
        6⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5414.exe
        7⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21637.exe
        8⤵
        
        PID:10620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43265.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60510.exe
        7⤵
        
        PID:9732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14432.exe
        7⤵
        
        PID:11668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21780.exe
        6⤵
        
        PID:7796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11579.exe
        6⤵
        
        PID:10104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12530.exe
        6⤵
        
        PID:15128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25430.exe
        5⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13686.exe
        6⤵
        
        PID:8048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50884.exe
        6⤵
        
        PID:11328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47209.exe
        6⤵
        
        PID:13028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62343.exe
        5⤵
        
        PID:7624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27603.exe
        5⤵
        
        PID:7776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38525.exe
        5⤵
        
        PID:15156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38293.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43743.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17231.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36831.exe
        7⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35975.exe
        8⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35451.exe
        9⤵
        
        PID:9864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60588.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:12328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1029.exe
        8⤵
        
        PID:8364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39566.exe
        8⤵
        
        PID:12372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39051.exe
        7⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9192.exe
        8⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        8⤵
        
        PID:12768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13778.exe
        7⤵
        
        PID:8416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39837.exe
        7⤵
        
        PID:12964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36363.exe
        6⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12892.exe
        7⤵
        
        PID:9956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44444.exe
        7⤵
        
        PID:12764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30332.exe
        6⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51393.exe
        7⤵
        
        PID:15688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60972.exe
        6⤵
        
        PID:11316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37994.exe
        6⤵
        
        PID:15264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57945.exe
        5⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5850.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13276.exe
        7⤵
        
        PID:9264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21885.exe
        7⤵
        
        PID:12868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-261.exe
        6⤵
        
        PID:8800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2398.exe
        6⤵
        
        PID:11796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15933.exe
        6⤵
        
        PID:15240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21127.exe
        5⤵
        
        PID:1572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52493.exe
        6⤵
        
        PID:10424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42279.exe
        6⤵
        
        PID:14976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55711.exe
        5⤵
        
        PID:8984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48599.exe
        5⤵
        
        PID:11772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40471.exe
        5⤵
        
        PID:13300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23222.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31957.exe
        5⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38283.exe
        6⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13276.exe
        7⤵
        
        PID:9236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42881.exe
        7⤵
        
        PID:13764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58511.exe
        6⤵
        
        PID:8964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43074.exe
        6⤵
        
        PID:11780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62115.exe
        6⤵
        
        PID:14496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15262.exe
        5⤵
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13660.exe
        6⤵
        
        PID:10120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42881.exe
        6⤵
        
        PID:13776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49026.exe
        5⤵
        
        PID:8640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44139.exe
        5⤵
        
        PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45579.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13265.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10126.exe
        5⤵
        
        PID:6208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51211.exe
        6⤵
        
        PID:9620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-697.exe
        6⤵
        
        PID:3092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28849.exe
        5⤵
        
        PID:7016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20296.exe
        5⤵
        
        PID:10816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48606.exe
        5⤵
        
        PID:916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57195.exe
      4⤵
      PID:6764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40303.exe
        5⤵
        
        PID:7660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21885.exe
        5⤵
        
        PID:2500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13711.exe
      4⤵
      PID:8316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1486.exe
        5⤵
        
        PID:14048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44669.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16994.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16145.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16145.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60105.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19971.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46587.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-74.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-74.exe
        8⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4127.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55491.exe
        9⤵
        
        PID:11992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15933.exe
        9⤵
        
        PID:15100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32419.exe
        8⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5108.exe
        9⤵
        
        PID:9760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21885.exe
        9⤵
        
        PID:13016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54209.exe
        8⤵
        
        PID:10216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10759.exe
        8⤵
        
        PID:13488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34609.exe
        7⤵
        
        PID:808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29639.exe
        8⤵
        
        PID:8280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63249.exe
        8⤵
        
        PID:12840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6971.exe
        8⤵
        
        PID:16112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64759.exe
        7⤵
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46603.exe
        8⤵
        
        PID:14244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25778.exe
        7⤵
        
        PID:10884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12530.exe
        7⤵
        
        PID:15136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63286.exe
        6⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54475.exe
        7⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29639.exe
        8⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5804 -s 636
        8⤵
        Program crash
        
        PID:9908
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 600
        7⤵
        Program crash
        
        PID:7708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49497.exe
        6⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5492.exe
        7⤵
        
        PID:8904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21885.exe
        7⤵
        
        PID:12884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30360.exe
        6⤵
        
        PID:7640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44139.exe
        6⤵
        
        PID:9632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21459.exe
        6⤵
        
        PID:15296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38999.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13722.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41709.exe
        7⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52913.exe
        8⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60531.exe
        9⤵
        
        PID:10520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36659.exe
        9⤵
        
        PID:13596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26903.exe
        8⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62124.exe
        8⤵
        
        PID:12296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1527.exe
        7⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43811.exe
        8⤵
        
        PID:10076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52612.exe
        8⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33622.exe
        7⤵
        
        PID:9196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14293.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30210.exe
        7⤵
        
        PID:13928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41661.exe
        6⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3935.exe
        7⤵
        
        PID:8936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33508.exe
        7⤵
        
        PID:12188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49182.exe
        7⤵
        
        PID:15336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46155.exe
        6⤵
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37589.exe
        7⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42881.exe
        7⤵
        
        PID:13784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60074.exe
        6⤵
        
        PID:10200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53817.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13688
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13688 -s 464
        7⤵
        Program crash
        
        PID:16208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60685.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-74.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-74.exe
        6⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17501.exe
        7⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12653.exe
        8⤵
        
        PID:10600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57001.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57028.exe
        7⤵
        
        PID:9036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37209.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15933.exe
        7⤵
        
        PID:15268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8517.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48087.exe
        7⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21885.exe
        7⤵
        
        PID:2840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13778.exe
        6⤵
        
        PID:8436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39374.exe
        6⤵
        
        PID:12212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40517.exe
        6⤵
        
        PID:1404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54210.exe
        5⤵
        
        PID:4184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3380.exe
        6⤵
        
        PID:9192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50884.exe
        6⤵
        
        PID:11312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4230.exe
        6⤵
        
        PID:15168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-314.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2254.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4661.exe
        5⤵
        
        PID:10404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13060.exe
        5⤵
        
        PID:15112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52835.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50671.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21673.exe
        7⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21009.exe
        8⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60531.exe
        9⤵
        
        PID:10360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        9⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24084.exe
        8⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-141.exe
        8⤵
        
        PID:13256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23404.exe
        7⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19629.exe
        8⤵
        
        PID:9172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40681.exe
        8⤵
        
        PID:15052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48808.exe
        7⤵
        
        PID:9500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11632.exe
        7⤵
        
        PID:11952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2959.exe
        6⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5736.exe
        7⤵
        
        PID:8204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6561.exe
        7⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64915.exe
        7⤵
        
        PID:13676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29452.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47229.exe
        6⤵
        
        PID:11484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6044.exe
        6⤵
        
        PID:13140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63286.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59327.exe
        6⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21829.exe
        7⤵
        
        PID:10508
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6032 -s 636
        7⤵
        Program crash
        
        PID:13228
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 616
        6⤵
        Program crash
        
        PID:7780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64079.exe
        5⤵
        
        PID:6780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49841.exe
        6⤵
        
        PID:9932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42881.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38912.exe
        5⤵
        
        PID:8304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34735.exe
        6⤵
        
        PID:13868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44139.exe
        5⤵
        
        PID:10036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45579.exe
        5⤵
        
        PID:14504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20062.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54755.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:60
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36831.exe
        6⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34029.exe
        7⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64039.exe
        8⤵
        
        PID:9764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60588.exe
        8⤵
        
        PID:12352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19887.exe
        7⤵
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58013.exe
        7⤵
        
        PID:12096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49182.exe
        7⤵
        
        PID:4012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2295.exe
        6⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34019.exe
        7⤵
        
        PID:10696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5523.exe
        7⤵
        
        PID:14408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13778.exe
        6⤵
        
        PID:8648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41975.exe
        6⤵
        
        PID:13020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36363.exe
        5⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49841.exe
        6⤵
        
        PID:9660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21885.exe
        6⤵
        
        PID:13108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65143.exe
        5⤵
        
        PID:7684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1486.exe
        6⤵
        
        PID:14040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-174.exe
        5⤵
        
        PID:12416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63068.exe
        5⤵
        
        PID:15952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17349.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57059.exe
        5⤵
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3598.exe
        6⤵
        
        PID:1504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33203.exe
        6⤵
        
        PID:11396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40795.exe
        6⤵
        
        PID:13836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48564.exe
        5⤵
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25721.exe
        6⤵
        
        PID:10304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42881.exe
        6⤵
        
        PID:13800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42943.exe
        5⤵
        
        PID:9468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20297.exe
        5⤵
        
        PID:12176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46759.exe
      4⤵
      PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60967.exe
        5⤵
        
        PID:8244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33203.exe
        5⤵
        
        PID:11356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45677.exe
      4⤵
      PID:6880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7739.exe
        5⤵
        
        PID:10936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19258.exe
        5⤵
        
        PID:14380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9344.exe
      4⤵
      PID:7540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46630.exe
      4⤵
      PID:13512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35693.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35693.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29545.exe
      4⤵
      Executes dropped EXE
      PID:3220
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 248
        5⤵
        Program crash
        
        PID:552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55118.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57251.exe
        5⤵
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54937.exe
        6⤵
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33203.exe
        6⤵
        
        PID:11372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51278.exe
        5⤵
        
        PID:7184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39727.exe
        6⤵
        
        PID:1092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        6⤵
        
        PID:2408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11614.exe
        5⤵
        
        PID:10072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28056.exe
        5⤵
        
        PID:13932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39985.exe
      4⤵
      PID:3676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10946.exe
        5⤵
        
        PID:9860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42881.exe
        5⤵
        
        PID:13732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54672.exe
      4⤵
      PID:7616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44139.exe
      4⤵
      PID:9048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45579.exe
      4⤵
      PID:14724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41532.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41532.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54371.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3006.exe
        5⤵
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26655.exe
        6⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33457.exe
        7⤵
        
        PID:10760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57001.exe
        7⤵
        
        PID:13900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59576.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39566.exe
        6⤵
        
        PID:12364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26223.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25721.exe
        6⤵
        
        PID:10428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24215.exe
        6⤵
        
        PID:13556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27016.exe
        5⤵
        
        PID:8456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22077.exe
        5⤵
        
        PID:4576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37994.exe
        5⤵
        
        PID:15228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41661.exe
      4⤵
      PID:5864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37921.exe
        5⤵
        
        PID:6872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13084.exe
        6⤵
        
        PID:10044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52612.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13281.exe
        5⤵
        
        PID:8448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8284.exe
        6⤵
        
        PID:13504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39566.exe
        5⤵
        
        PID:12356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61339.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9192.exe
        5⤵
        
        PID:9260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21885.exe
        5⤵
        
        PID:12716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5253.exe
      4⤵
      PID:7404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20402.exe
      4⤵
      PID:12048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23981.exe
      4⤵
      PID:2956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37656.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37656.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53167.exe
      4⤵
      PID:6040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64563.exe
        5⤵
        
        PID:6848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23199.exe
        6⤵
        
        PID:9888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60588.exe
        6⤵
        
        PID:13124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9197.exe
        5⤵
        
        PID:8408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39566.exe
        5⤵
        
        PID:12344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12793.exe
      4⤵
      PID:6560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9192.exe
        5⤵
        
        PID:7584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        5⤵
        
        PID:5784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21946.exe
      4⤵
      PID:8028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61356.exe
      4⤵
      PID:11980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7268.exe
      4⤵
      PID:15256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30763.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30763.exe
    3⤵
    PID:5932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13686.exe
      4⤵
      PID:9144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52830.exe
      4⤵
      PID:11516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4230.exe
      4⤵
      PID:15184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60159.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60159.exe
    3⤵
    PID:7960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-196.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-196.exe
    3⤵
    PID:10616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13605.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13605.exe
    3⤵
    PID:14664
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33659.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33659.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36011.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36011.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45907.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27215.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49711.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49301.exe
        7⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49021.exe
        8⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44003.exe
        9⤵
        
        PID:9360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        9⤵
        
        PID:216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42559.exe
        8⤵
        
        PID:9064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39758.exe
        8⤵
        
        PID:11408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44409.exe
        8⤵
        
        PID:15160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56950.exe
        7⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5108.exe
        8⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        8⤵
        
        PID:13412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27016.exe
        7⤵
        
        PID:8464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52804.exe
        7⤵
        
        PID:11508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62115.exe
        7⤵
        
        PID:14476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2793.exe
        6⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44937.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37589.exe
        8⤵
        
        PID:9820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21885.exe
        8⤵
        
        PID:13100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8429.exe
        7⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62124.exe
        7⤵
        
        PID:12304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46547.exe
        7⤵
        
        PID:15544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16249.exe
        6⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5108.exe
        7⤵
        
        PID:9528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10978.exe
        6⤵
        
        PID:9044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59098.exe
        6⤵
        
        PID:12276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7798.exe
        6⤵
        
        PID:2976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46566.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31403.exe
        6⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49021.exe
        7⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5108.exe
        8⤵
        
        PID:9312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        8⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27592.exe
        7⤵
        
        PID:8380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60449.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47307.exe
        7⤵
        
        PID:16120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-951.exe
        6⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25145.exe
        7⤵
        
        PID:9680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-697.exe
        7⤵
        
        PID:12220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4074.exe
        6⤵
        
        PID:7768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-174.exe
        6⤵
        
        PID:12388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49559.exe
        5⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36141.exe
        6⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17683.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31781.exe
        7⤵
        
        PID:13644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60510.exe
        6⤵
        
        PID:9728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14432.exe
        6⤵
        
        PID:12432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1257.exe
        5⤵
        
        PID:1820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37065.exe
        6⤵
        
        PID:14592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8814.exe
        5⤵
        
        PID:9628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51096.exe
        5⤵
        
        PID:13472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19601.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50671.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38777.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64563.exe
        7⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44195.exe
        8⤵
        
        PID:10636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43265.exe
        8⤵
        
        PID:13880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24084.exe
        7⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29068.exe
        7⤵
        
        PID:12112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40517.exe
        7⤵
        
        PID:2836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47412.exe
        6⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6862.exe
        7⤵
        
        PID:7752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21885.exe
        7⤵
        
        PID:12876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13778.exe
        6⤵
        
        PID:8860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45212.exe
        6⤵
        
        PID:12256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7268.exe
        6⤵
        
        PID:15232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65336.exe
        5⤵
        
        PID:3840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13686.exe
        6⤵
        
        PID:9124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32409.exe
        6⤵
        
        PID:2176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63005.exe
        5⤵
        
        PID:8168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2986.exe
        6⤵
        
        PID:15204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17993.exe
        5⤵
        
        PID:11476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7268.exe
        5⤵
        
        PID:15088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53312.exe
      4⤵
      PID:5392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58341.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39727.exe
        6⤵
        
        PID:9824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21885.exe
        6⤵
        
        PID:12000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24084.exe
        5⤵
        
        PID:8072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16477.exe
        5⤵
        
        PID:11956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45903.exe
      4⤵
      PID:6676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13276.exe
        5⤵
        
        PID:9244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        5⤵
        
        PID:9896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59980.exe
      4⤵
      PID:8996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37077.exe
      4⤵
      PID:12248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51804.exe
      4⤵
      PID:15196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34209.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34209.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-572.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13722.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21673.exe
        6⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54065.exe
        7⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19499.exe
        8⤵
        
        PID:10468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8376.exe
        8⤵
        
        PID:14192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3935.exe
        7⤵
        
        PID:8908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33508.exe
        7⤵
        
        PID:12204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49182.exe
        7⤵
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29321.exe
        6⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46743.exe
        7⤵
        
        PID:9280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63520.exe
        7⤵
        
        PID:12440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16866.exe
        7⤵
        
        PID:15868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30882.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49872.exe
        6⤵
        
        PID:7772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11736.exe
        6⤵
        
        PID:15528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2959.exe
        5⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26157.exe
        6⤵
        
        PID:8012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33203.exe
        6⤵
        
        PID:11384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16388.exe
        5⤵
        
        PID:7324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25721.exe
        6⤵
        
        PID:10268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        6⤵
        
        PID:13296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41792.exe
        5⤵
        
        PID:10372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21336.exe
        5⤵
        
        PID:14208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43057.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:64
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57251.exe
        5⤵
        
        PID:6056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1330.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5108.exe
        7⤵
        
        PID:9712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        7⤵
        
        PID:9532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29207.exe
        6⤵
        
        PID:9508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14432.exe
        6⤵
        
        PID:11680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51278.exe
        5⤵
        
        PID:7176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50801.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43265.exe
        6⤵
        
        PID:13872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11614.exe
        5⤵
        
        PID:10532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21449.exe
        5⤵
        
        PID:13580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15288.exe
      4⤵
      PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29639.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33587.exe
        5⤵
        
        PID:11944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10068.exe
        5⤵
        
        PID:15220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36198.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24429.exe
        5⤵
        
        PID:13464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17496.exe
      4⤵
      PID:9300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
      4⤵
      PID:4084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41697.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41697.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13722.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-74.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-74.exe
        5⤵
        
        PID:5884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43733.exe
        6⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34735.exe
        7⤵
        
        PID:13552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29207.exe
        6⤵
        
        PID:9520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14432.exe
        6⤵
        
        PID:11688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60675.exe
        5⤵
        
        PID:7904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29862.exe
        5⤵
        
        PID:10552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12530.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34609.exe
      4⤵
      PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13686.exe
        5⤵
        
        PID:8544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2180.exe
        5⤵
        
        PID:13180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62429.exe
      4⤵
      PID:7896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29862.exe
      4⤵
      PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12530.exe
      4⤵
      PID:15144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5097.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5097.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63774.exe
      4⤵
      PID:6352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29639.exe
        5⤵
        
        PID:8360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        5⤵
        
        PID:12016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-.exe
        5⤵
        
        PID:4452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28002.exe
      4⤵
      PID:6996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30900.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7418.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7418.exe
    3⤵
    PID:6288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29639.exe
      4⤵
      PID:7568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33510.exe
      4⤵
      PID:2724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39393.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39393.exe
    3⤵
    PID:7208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44669.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44669.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:10248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16994.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16994.exe
    3⤵
    PID:1972
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29880.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29880.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41823.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41823.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43743.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3032.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21673.exe
        6⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18627.exe
        7⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37589.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        8⤵
        
        PID:13356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51356.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57001.exe
        7⤵
        
        PID:13920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21921.exe
        6⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34351.exe
        7⤵
        
        PID:14232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42943.exe
        6⤵
        
        PID:9488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51679.exe
        6⤵
        
        PID:13624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2959.exe
        5⤵
        
        PID:5220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54361.exe
        6⤵
        
        PID:7988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25851.exe
        7⤵
        
        PID:10456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5139.exe
        7⤵
        
        PID:13668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10261.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44111.exe
        6⤵
        
        PID:15244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5698.exe
        5⤵
        
        PID:7236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55679.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        6⤵
        
        PID:12804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16920.exe
        5⤵
        
        PID:10756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65460.exe
        5⤵
        
        PID:14400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43057.exe
      4⤵
      PID:1300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53551.exe
        5⤵
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7801.exe
        6⤵
        
        PID:6868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56617.exe
        6⤵
        
        PID:13680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57500.exe
        5⤵
        
        PID:7232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60531.exe
        6⤵
        
        PID:10568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8455.exe
        6⤵
        
        PID:14160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29670.exe
        5⤵
        
        PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16458.exe
        5⤵
        
        PID:14392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58459.exe
      4⤵
      PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20127.exe
        5⤵
        
        PID:7600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33203.exe
        5⤵
        
        PID:11364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25892.exe
      4⤵
      PID:7556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44139.exe
      4⤵
      PID:9228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21459.exe
      4⤵
      PID:1440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9487.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9487.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50671.exe
      4⤵
      Executes dropped EXE
      PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51989.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29639.exe
        6⤵
        
        PID:8180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33587.exe
        6⤵
        
        PID:11936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43317.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44610.exe
        5⤵
        
        PID:7888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23996.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21195.exe
        5⤵
        
        PID:15104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11370.exe
      4⤵
      PID:7044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9192.exe
        5⤵
        
        PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        5⤵
        
        PID:13348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32882.exe
      4⤵
      PID:8440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13412.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15429.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11484.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11484.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6104.exe
      4⤵
      PID:5980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7002.exe
        5⤵
        
        PID:7060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9192.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        6⤵
        
        PID:8572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9197.exe
        5⤵
        
        PID:8400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46939.exe
        5⤵
        
        PID:11488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46660.exe
        5⤵
        
        PID:15284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16877.exe
      4⤵
      PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3162.exe
        5⤵
        
        PID:10392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        5⤵
        
        PID:13316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54811.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29068.exe
      4⤵
      PID:12456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14066.exe
      4⤵
      PID:15932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55964.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55964.exe
    3⤵
    PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6670.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58834.exe
      4⤵
      PID:13232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11196.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11196.exe
    3⤵
    PID:7608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35771.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35771.exe
    3⤵
    PID:11296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3756.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3756.exe
    3⤵
    PID:16280
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53810.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53810.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14962.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14962.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3224.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59607.exe
        5⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50391.exe
        6⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16105.exe
        7⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27475.exe
        8⤵
        
        PID:9916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        8⤵
        
        PID:13324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47080.exe
        7⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4894.exe
        7⤵
        
        PID:13528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16213.exe
        6⤵
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35835.exe
        7⤵
        
        PID:9668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        7⤵
        
        PID:4328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30856.exe
        6⤵
        
        PID:10728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62866.exe
        6⤵
        
        PID:13892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8543.exe
        5⤵
        
        PID:6320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39727.exe
        6⤵
        
        PID:2360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21885.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58729.exe
        5⤵
        
        PID:7128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-174.exe
        5⤵
        
        PID:12424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16991.exe
      4⤵
      PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32877.exe
        5⤵
        
        PID:6512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46743.exe
        6⤵
        
        PID:9288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14127.exe
        6⤵
        
        PID:12704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50307.exe
        6⤵
        
        PID:16164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25149.exe
        5⤵
        
        PID:7656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55107.exe
        5⤵
        
        PID:11288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46660.exe
        5⤵
        
        PID:12852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24390.exe
      4⤵
      PID:6444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31175.exe
        5⤵
        
        PID:10060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        5⤵
        
        PID:3016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6815.exe
      4⤵
      PID:7476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42961.exe
      4⤵
      PID:12020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23981.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18553.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18553.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10126.exe
      4⤵
      PID:6192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37397.exe
        5⤵
        
        PID:9804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60588.exe
        5⤵
        
        PID:11932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44994.exe
      4⤵
      PID:1484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7324.exe
        5⤵
        
        PID:13848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12128.exe
      4⤵
      PID:11468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5243.exe
      4⤵
      PID:13660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21100.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21100.exe
    3⤵
    PID:6724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60531.exe
      4⤵
      PID:10416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
      4⤵
      PID:13364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4101.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4101.exe
    3⤵
    PID:8288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13412.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13412.exe
    3⤵
    PID:10488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45579.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45579.exe
    3⤵
    PID:11656
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57179.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57179.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38419.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38419.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25347.exe
      4⤵
      PID:2756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13686.exe
        5⤵
        
        PID:9180
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 636
        5⤵
        Program crash
        
        PID:12852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20681.exe
      4⤵
      PID:7396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39566.exe
      4⤵
      PID:12380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11370.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11370.exe
    3⤵
    PID:7036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41481.exe
      4⤵
      PID:9844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4200.exe
        5⤵
        
        PID:14292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60588.exe
      4⤵
      PID:12636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27236.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27236.exe
    3⤵
    PID:9152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34408.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34408.exe
    3⤵
    PID:11828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23981.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23981.exe
    3⤵
    PID:4428
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49517.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49517.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36831.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36831.exe
    3⤵
    PID:5992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15123.exe
      4⤵
      PID:6844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42633.exe
        5⤵
        
        PID:11004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10401.exe
        5⤵
        
        PID:14200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13778.exe
      4⤵
      PID:8736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39374.exe
      4⤵
      PID:12192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40517.exe
      4⤵
      PID:14984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47604.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47604.exe
    3⤵
    PID:6480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58585.exe
      4⤵
      PID:10544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8455.exe
      4⤵
      PID:14152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54811.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54811.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28067.exe
      4⤵
      PID:13956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43119.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43119.exe
    3⤵
    PID:11868
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47829.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47829.exe
  2⤵
  PID:5908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29639.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29639.exe
    3⤵
    PID:7508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9467.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9467.exe
    3⤵
    PID:12104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10068.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10068.exe
    3⤵
    PID:2712
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25006.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25006.exe
  2⤵
  PID:7676
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56697.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56697.exe
  2⤵
  PID:11272
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17805.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17805.exe
  2⤵
  PID:14660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3220 -ip 3220
1⤵
PID:2836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 6140 -ip 6140
1⤵
PID:7016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5068 -ip 5068
1⤵
PID:7396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4412 -ip 4412
1⤵
PID:7640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5804 -ip 5804
1⤵
PID:4576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2756 -ip 2756
1⤵
PID:11548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 6032 -ip 6032
1⤵
PID:12716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 13688 -ip 13688
1⤵
PID:15916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-11241.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
Size 468KB
SHA256 b5914bf37215226d8474cf598a14dd4b3f53143a91e9af4e2104349ab6e70eae
MD5 925a27638dfd6dec3bb8f97667beadf8
SHA1 764a8cd9ca7fb05769f4966d3f1377770f9c38ed
SHA512 365e08133fb5a4b63b963a2dcff44ca0734a0cbe1e1ec3cf119a05cd60a1263ff99535730a07f8c3a438012ab68f60dd5416ce22279e983af84ae2fcc0846643
SSDEEP 3072:OTGcogzda88Un+/hP55FTo5K4ezWI8JEQHe5Vm/2x13J43QL8lP:OTVoVRUniPfFToxxCc2xFC3QL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-14962.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-14962.exe
Size 468KB
SHA256 88aed830f52643020441244d5be6c44f5b2deed042ffd57a0581352cc2504221
MD5 aaf6e298cddca9f048ffcd09d8b6f2d2
SHA1 72a7d26d5e43166a1d6c737870dd49a16361c8d0
SHA512 b07a40739696f48bb789c6946a546560f5d51c68d8f883c2accd9b8fae601ea48780c542f17b35567dc1522c6e13dff1da45eb988896972fe7e3a5bd79454112
SSDEEP 3072:OXGcogzda88Un+/bP55FTo5K4ezWI8JEQHe5Vm/2xg3Df3QL8lP:OXVoVRUnoPfFToxxCc2xeD3QL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-15180.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-15180.exe
Size 468KB
SHA256 10898d4e1723744be409524a4d1b68e74af2df0cd3ad53d15d97613dca71b613
MD5 4d4950d2f05aa99c707f5fa5f599312a
SHA1 da7cde3925428c1701e6b61965915720d51aeb61
SHA512 144cbd9b47cd68ab93f0949f9c6286ad8edf7bacdcaf95688c0186d30391c378710a3eb93c0bd69fecd33ea512312a4aee35857f760562c6015199bfad076a92
SSDEEP 3072:OTGcogzda88Un+/YP55FTo5K4ezWI8nEQHe5Vm/2xg3D93QL8lP:OTVoVRUnfPfFToxx0c2xep3QL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-16145.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-16145.exe
Size 468KB
SHA256 ac89798563f2e196368393318e0420b45cc04b575bd3d80e4f78a3c04c607f7a
MD5 798bc166b811d8fc6e1f5516a2ff0a5f
SHA1 d97ccc096207f4f952f6171f8dbabadeb1aad0dc
SHA512 f3b1501b7c6a5eb96d73648db9e4f4824752c9f1220d259ec69d54316bcc6a1dbce0a96d4804c2de8922e2cca1040e8c502b2917ba5a5b1b05764cd337324170
SSDEEP 3072:OTGcogzda88Un+/hP55FTo5K4ezWI8JEQHe5Vm/2xg3J43QL8lP:OTVoVRUniPfFToxxCc2xeC3QL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-19601.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-19601.exe
Size 468KB
SHA256 bbb314aace1d199f9dc2c4cdc4747795393eee6c783f887f460e448229da7672
MD5 bf54348455bf60ee7520dc2237e25e68
SHA1 27311f57603f16bfcfc398c12265e21056054d87
SHA512 10b1fa1ffe3ad039839ea06cb96a665e6da08f24470a0e50d526d880f8910c2ee1d3289dc9e8338f73ce9b1048993e08ce93d1e04bbd1dbbe7186d58216c5548
SSDEEP 3072:OTGcogzda88Un+/hP55FTo5K4ezWI8JEQHe5Vm/4xg3Dy3QL8lQ:OTVoVRUniPfFToxxCc4xe23QL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-19971.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-19971.exe
Size 468KB
SHA256 623eb04f4ec374472c6c5aa9c4e91c8d4f5c6a2fd2be96a8b70e57f104633fc3
MD5 c0496ef253b52b8edcbd6cb3753c07b2
SHA1 f73c1d13b3709b805aec47410517365798415c47
SHA512 0206601d9f655cd5570a46f302a87bf0015a677e91f54a671612e4f049ca9e77b3b71030724defc7d3c808734e20e471ae52285e9f912b8a2c977c27bfb4896c
SSDEEP 3072:OTGcogzda88Un+/hP55FTo5K4DzWI8JEQHe5Vm/2xg3J43QLElP:OTVoVRUniPfFToexCc2xeC3QL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-21931.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-21931.exe
Size 468KB
SHA256 6b586890cc0dc19415a40d7b6a3d66494337af2b843cc95ac79985cddf5fe1e4
MD5 eb0edf00c3cb9c57b6a9eafb8b1aa6ff
SHA1 f70533c855d2b2a161d651b98142446f9de8a7d7
SHA512 3ce77c13c8540d26eaa90ca69c7aab5f0ab89094059ec725892144eb7fc9462f5715d086d5c3f289df93a1a0aaa21f8ed7c6ff6c2cdaca710070b64f5929dced
SSDEEP 3072:OTGcogzda88Un+/hP55FTo5K4ezWI8nEQHe5Vm/2xg3D9mQL8lP:OTVoVRUniPfFToxx0c2xepmQL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-23222.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-23222.exe
Size 468KB
SHA256 9820b52dae2edc7f0ab17fbbf4d06925d23c5005e5af3de8d591421436395642
MD5 6d38c7004f7acaed1131207473fe5389
SHA1 67d744dd8f02d96c75702c6b9a17ab3e29c152b4
SHA512 e31e85d8fb7c99fa18a5460a0f22263992a8d5e4d67a9c248c4cfe31bd1e4d572198e2d8064d2a50dc44c676c847f8de075cd0eb1b3016246ce5970eabdaf11a
SSDEEP 3072:OTGcogzda88Un+/hP55FFo5K4ezWI8JEQHe5Vm/2xg3D93QL8lP:OTVoVRUniPfFFoxxCc2xep3QL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-23759.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-23759.exe
Size 468KB
SHA256 7bd9f2d20613a2e62d9b96e7e40348c88f4a9ea769bd2342c8c9d1db4354e920
MD5 cdbcacace4faa6d849896c3f4ccf5342
SHA1 4ebe8a724a1cac5b08193648d71b42d16ddb1111
SHA512 07e1e8dee8a643fc2d379e1033e85d8c9be22f849c3c9e2ea21d1af8ad4429b1103308d8792b0734c669a0bf77f7e846fdb2cb29212c048591a915c1b6bb237c
SSDEEP 3072:OTGcogzda88Un+/hP55FTo5K4ezWI8nEQHe5Vm/2xg3D93QL8lP:OTVoVRUniPfFToxx0c2xep3QL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-27215.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-27215.exe
Size 468KB
SHA256 33cbf8b7a1e4acc772090b5e46588b5ce950d102971fc4adf3bee5898dc11445
MD5 b65e5b2443a54a92a3e6a5e211343919
SHA1 cac990652cc597b4df3f3dfe5f07ddb2707de5f2
SHA512 458b2b4b2e4eebcd908b8ae1355a36b7d1b89588a2aa8396dc04cbfa7785de9c5a1cd821861e3eb5cd8b6c429e108591b1cb3579d51654b78f5ea6bde7d95029
SSDEEP 3072:OTGcogzda88Un+/hP55FTo5K4ezWI8JEQHe5V5/4xg3zf3QL8lQ:OTVoVRUniPfFToxxCp4xez3QL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-29545.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-29545.exe
Size 468KB
SHA256 40d76075a55b4c48b8f9d2c699ff3152cbfaf3185eedc56769f8d1a52d123122
MD5 9ae6e5caa49237c0ca0f27655ccda840
SHA1 13286a82d9f73e44dbbda826ed2807cf783b49b3
SHA512 f25f68fe91e69391ec30ccb74db02044c5b2ffbc95fd9fd03ba87319a38ab9ef524afd631d516f797382c98bab974e062e062ae4425b3e59aa534a6c86ce30fa
SSDEEP 3072:OTGcogzda88Un+/hP55FTo5K4ezWI8JEQHe5VmS2xg3D43QL8lP:OTVoVRUniPfFToxxCR2xes3QL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-29880.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-29880.exe
Size 468KB
SHA256 28793f2a0315e42665baee76930060c6aa211e24327e149e53ba3845a59cbd1a
MD5 b380280314e539edffa20d9ebe2b0f86
SHA1 3dae1df78c96b0bce1ec8b3105c59b0a5d10972b
SHA512 60feb56a2488792ae849b67adbbe915bbd24e1ccbb26eec3b0db5f6d93fc9b23bac30cf11f1e09c70e1a1ab5b7b0d8ff38b9e55e85250cdf2dfe93a844e6d6fc
SSDEEP 3072:OTGcogzda88Un+/hP55FTo5K4ezWI8ZEQHe5Vm/2xg3Df3QL8lP:OTVoVRUniPfFToxxyc2xeD3QL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-33659.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-33659.exe
Size 468KB
SHA256 36c75c02ad9a7e25f67106eccad1e7a833df530edfa39d94b9bb4af01f1050f5
MD5 5cd08d6e05b54670fede1016fa71f940
SHA1 bd1010364196433aa62289cd57cd0ef57333d556
SHA512 7f158099aa131d82c23f086284ca113ac5b6f91aa2d344431cc4db944b746785552a9174c957e3c25f75d1ac76390b2278e695dcb76310dc58847b042b434c4c
SSDEEP 3072:OTGcogzda88Un+/hP55FTo5K4ezWI8JEQHe5Vm/2xg3Df3QL8lQ:OTVoVRUniPfFToxxCc2xeD3QL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-34209.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-34209.exe
Size 468KB
SHA256 250b59af617a790da3313137f1ba77c4bca37109aa753f25a23547edc55284a9
MD5 000d441dce32c47c970b64cae541220e
SHA1 b44128d875ca41804e0ea5dc3de9f9468f718640
SHA512 387fa3d3391b6ead09ef0a3bf70020751db9e06a97a0fe67d3e859d3a4a154c728d5123f40b5ca7202eeda24599ce2e8970929648fe764472c1efb85a3f80765
SSDEEP 3072:OTGcogzda88Un+/hP55FTo5K4ezWI8JEQHe5Vm/2xg3Df3QL8lr:OTVoVRUniPfFToxxCc2xeD3QL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-35693.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-35693.exe
Size 468KB
SHA256 9bf3310eeafb20d079fe384658a5fa2e309675d9f9f746899e6f47ae2e6ac398
MD5 abc4b3bec1438a2fc2125de3b573156f
SHA1 fc59f4091f89403c575dd4f4387e40d9b572c402
SHA512 ab7abf557453459a6d023fa3373073e30ef733404a3104d2a064af3dadeb9d76be09f7bc340c21d876587debd7d09af3c7ee78ac75ae676c0d83f5fe14e88e97
SSDEEP 3072:OTGcogzda88Un+/hP55FTo5K4ezWI8JEQHe5Vml2xg3D43QL8lP:OTVoVRUniPfFToxxCm2xes3QL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-36011.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-36011.exe
Size 468KB
SHA256 f0cd93672947caf0d764a77320b74fff53d405e64f5aee9db091b206e48be285
MD5 431749774452b92d639a5d69063f7288
SHA1 045cd86eff47b67e20f2c018b0359c43fc67dc3e
SHA512 469737a55d5b2f2327dd70643d6e731dd540f49a6b7d47a49ba375d2ea78e9a4484f6bf2723ca963e23c91886b9a0773248b5051cc671bc69829294e095e94ea
SSDEEP 3072:OTGcogzda88Un+/hP55FTo5K4ezWI8JEQHe5Vm/4xg3Df3QL8lQ:OTVoVRUniPfFToxxCc4xeD3QL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-38293.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-38293.exe
Size 468KB
SHA256 5d1f9841207e9d6e3a7cf7543229a364243d7caa1fb7501ff88c7a6f9e55e5f3
MD5 d1ba28aa8601542deae3997e8c10cf32
SHA1 90ce813d0d378b7a9ec303098882a74af69c17df
SHA512 2e9e6f59527aff42260b1ead97c4c6f2789ec81cedf4e2a0a142a5532b964b2da28ca9b7c6caa464265da5c8aa6a21c8198e9c9cfe22bab0d13a06c2fd6df537
SSDEEP 3072:OTGcogzda88Un+/hP55FTo5K4ezWI8JEQHe5Vm/2xg3D93QL8lj:OTVoVRUniPfFToxxCc2xep3QL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-41532.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-41532.exe
Size 468KB
SHA256 6d0802699804d4a0fc4ca746a5dc5e7ee43b973434c7d4a82df41cf3b5fc09cd
MD5 4ce3bfe227506491d08596be2b80afa9
SHA1 cecbf34e8fa8aabda5f1baccc9ead2d81ab52a19
SHA512 b0427455c59c1a671c7e29a9fa91ca6d3800c7ab30acb667c0c8f1fde503e3595dacf80b94b0f33b82673fb20c1b67a17ea3c1698bc4f3ac0b98941fcbafa3eb
SSDEEP 3072:OTGcogzda88Un+/hP55FTo5K4ezWI8JEQHe5Vm/2xg3D43QLLlP:OTVoVRUniPfFToxxCc2xes3QL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-41697.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-41697.exe
Size 468KB
SHA256 2b9cbb5826fbf1bf4ddbbc553fb2a62dd4943deacf8611266ee854ea254a6ed7
MD5 f2b40fcf24e561c4e505c27443c56d68
SHA1 aba71bb409c7732ee6ccc6d6668ce711c2ae9cca
SHA512 95c9fe2a226074b2a923cd62f438479ed136ae0e45d63c2982a6eee07ea6f767cad079df6388f158a0bf6d43a2492726f3664a4d6ebf4e28d3c69b9843b018d3
SSDEEP 3072:OTGcogzda88Un+/hP55FTo5K4ezWI8JEQHe5Vm//xg3Df3QL8lQ:OTVoVRUniPfFToxxCc/xeD3QL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-41823.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-41823.exe
Size 468KB
SHA256 310b759c4445d8f05ea68c42118a96e26b4642d756ee76b8964b11212a0c4895
MD5 dfb3f081fd8d92be1347de71a7a0c9bb
SHA1 7bc5084f711dbc448201553a468efeb966b42bfb
SHA512 8a1cd4eefadbdf687053b154d0883d522e3ff14483979344b7536a2d9a9fac0b6de457b9da5bb49ffe2f5e027defaab00ee168b3c2e6bd80cdb2ed5c203d490c
SSDEEP 3072:OTGcogzda88Un+/hP55FTo5K4ezWI8ZEQHe5Vm/2xz3Df3QL8lP:OTVoVRUniPfFToxxyc2xrD3QL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-43743.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-43743.exe
Size 468KB
SHA256 50a1c7108ae4f035b868e77165d9cb2782c8da6b419d50d76b4cc01195272f09
MD5 676541493b2323472b9b1a518a04dda8
SHA1 599ecfaa08a28ad36ebf441eeded3ff5a5362222
SHA512 5fdf691b58c1a95223287f6caaddd97c2c99f5257fd0afe6ae6a381512b55aa7e1f270126d19ea8f1a6d864cbbb2eb10123274d426832801c5db3c451812ca3c
SSDEEP 3072:OTGcogzda88Un+/hP55FTo5K4ezWI8JEQHe5Vm/2xg3Q93QL8lj:OTVoVRUniPfFToxxCc2xeg3QL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-45907.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-45907.exe
Size 468KB
SHA256 aa8d79c26710a3adeaf431db683667c17963276c71e0a11ca9971b208480ba85
MD5 6950e48bd5436b926b67ef2a57631f9f
SHA1 e174bcbc9fe0b2ba7c97d09903243f8d2e3920f2
SHA512 275c0065e2363b7b8361bbee5725d488c888a4e1daa45c4b7e1a4cfab1de53b61a5fd7c78494494b6bca87ac1d3d999ebed6cc74d23a0a4f0381a3a9142ed685
SSDEEP 3072:OTGcogzda88Un+/hP55FTo5K4ezWI8JEQHe5Vm/4xg3zf3QL8lQ:OTVoVRUniPfFToxxCc4xez3QL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-49441.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-49441.exe
Size 468KB
SHA256 1efed1fe7eab188b280aeef702ba573b22180888fa145709db415b7657782f28
MD5 50c218d5e3d07abe7406b6a312a44440
SHA1 1acea4f285b1fb5078ebc5cf0e99574752a9fcd8
SHA512 99ca7e77b6cd7ecb9d1c88732e4b5881f05d2d4c5bc38d9fe6dd3301bd9281f58c55acfbb29183e79cac3eccd78e18d590e8e24bdc976daf7a056bb02f818079
SSDEEP 3072:OTGcogzda88Un+/hP55FTo5K4ezWI8JEQHe5Vm/2xg3D93QL8lP:OTVoVRUniPfFToxxCc2xep3QL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-49887.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-49887.exe
Size 468KB
SHA256 eee657ff7c22897680b2909a216888c146e17fb0d4c752a14b186570be3648d9
MD5 9fc787b6f648b274b3dd0b9d76058f41
SHA1 b738e69d64654a116a85b76d63383b18e0fe8ae6
SHA512 a44a2ada6d335b1c99c6c57a80b8ed5c45b1d10f2ed4da56d27d0ef303f44640192d44e9f7504f592e2c8cbaee4f94b71183b0446c9270dacf7f23bdd363c8f7
SSDEEP 3072:OTGcogzda88Un+/hP55FTo5K4ezWI8JEQHe5Vm/2xg3D43QL8lP:OTVoVRUniPfFToxxCc2xes3QL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-52103.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-52103.exe
Size 468KB
SHA256 7f0c20899f32229b794e2d13d01d38cac7bb00bbe5a1ca66c51d042f83edf941
MD5 a5c40d08658b0ff9df16c947d64d4bdb
SHA1 7c259b28f458c87473a18396f09c2d4a9ceaac9c
SHA512 2aa05a38e816a63fee37c9f25cf39133d778c7a99498de4e49b647f56ccabc1107427145ffd3627f71a8b581f9aa678e2f2651e227bb5f600c93c00c23b4f7bb
SSDEEP 3072:OTGcogzda88Un+/YP55FTo5K4ezWI8nEQHe5Vm/2xg3D9vQL8lP:OTVoVRUnfPfFToxx0c2xepvQL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-53810.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-53810.exe
Size 468KB
SHA256 ff0b7ba5ce78aa39a8e693a3e9813de0c3b35241aa50bcb7dcfb956cc8dac7e4
MD5 a79fad378e63733ce5339644d117f776
SHA1 cae6c7bab27befde4d24f78f666d14d02f9b8f86
SHA512 de36c7c2c69a0c81076be470ccc21b10c9ce31929d58088d7cd3153f3dc73bc6a851a8be32ec93bb8e3b9f4a04415e164d0077eb525f0344a39935914db44279
SSDEEP 3072:OXGcogzda88Un+/hP55FTo5K4ezWI8JEQHe5Vm/2xg3Df3QL8lP:OXVoVRUniPfFToxxCc2xeD3QL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-57179.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-57179.exe
Size 468KB
SHA256 e214a297c243f4a2755d540c0c27cff4afc5d6584679af0469d39e79e1726c9a
MD5 7583daba003ee02830b97aa100aeb1f8
SHA1 7299d60592c557ac141e893980bbd188c07e34af
SHA512 6fb301a00a5c638a64b463e9859fead39563771c7f8e159eb7a854b67e5800fa14004c0a31bf08e78a1680241a01fcdac43f688da9df0a2d6b4643a2e7fdbfe9
SSDEEP 3072:OTGcogzda88Un+/hP55FTo5K4ezWI8JEQHe5Vm/2xg3Df3QL8lP:OTVoVRUniPfFToxxCc2xeD3QL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-572.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-572.exe
Size 468KB
SHA256 1b07a2238b3728a4d3e1c9867d87d6f6c2e03149735ba28d47926ab65bcdab53
MD5 ca31036e10d504fa655c88e8b012a4eb
SHA1 dbec40f20f4af12a9c723433f42067cbe499a738
SHA512 2dbe2683e246f9790c26ccdc9e8abc6c96069d1dc78a7bd9993a3c0cf85b35b9760909934ac6a9c3dae8b731ac55746275e840696eb0a4643885f1fe4c147410
SSDEEP 3072:OTGcogzda88Un+/hP55FTo5K4ezWI8JEQHe5Vm/2xg3Df3QL8l8:OTVoVRUniPfFToxxCc2xeD3QL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-59311.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
Size 468KB
SHA256 1ffa5077359b981c3cd16a3ea7336e376325b65c778e11c9a1e0e518921f00b6
MD5 a85c202fc14c1cfbee00d11a7bce67e8
SHA1 1c344e8f9a2dcf6e9841b6529d271cc78f536a6c
SHA512 5745c76f85dd721661f1fd262fdf7de2f40c2fdb0c366f3705e7e6fd635315158b009fcd9281dbe5e3d328b5f30713b9c6da1d64ef02ec7c56b2c453b0d47df9
SSDEEP 3072:OTGcogzda88Un+/hP55FTo5K4ezWI8JEQHe5Vm/2xg3J43QLElP:OTVoVRUniPfFToxxCc2xeC3QL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-60105.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-60105.exe
Size 468KB
SHA256 cd46b80c4df738abb735691b69daf8ae74dc111f889c8c05da64fdc9e397785f
MD5 c9167b4288658770ba1bea0d2bd0f09d
SHA1 32d08aa52022a0506ace75059e82bc8e2c762d76
SHA512 02f5107b8b0a3622c07b0f50d1abd00676ce357a81341fdb53561c3323b1134152818f46fb53b2830b4344674c4e9656d836f71ae3edddf4763c89c92aaf0466
SSDEEP 3072:OTGcogzda88Un+/hP55FTo5K4ezWI8JEQHe5Vm/2xg3J43QLplP:OTVoVRUniPfFToxxCc2xeC3QL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-9487.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-9487.exe
Size 468KB
SHA256 539249915a974c9b910ae2d62065367a197bc6831ce689000df2ce2bee313858
MD5 6cf83d59fd9ee7a1d094322e38dc4516
SHA1 815af536ee97144214a43620654245c24ee2ddab
SHA512 740874b71095b18da5256a44722e6fa449851ebb7a6ddcec7abfcf5ed3954bd73b354153e56c4fa45fddfba77e298a810cf5e5d5ef4c84ab0b4555759cfa0082
SSDEEP 3072:OTGcogzda88Un+/hP55FTo5K4ezWI8ZEQHe5Vm/2xC3Df3QL8lP:OTVoVRUniPfFToxxyc2xwD3QL
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/60-317-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/64-376-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/208-186-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/232-231-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/392-290-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/432-313-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/540-232-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/768-97-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/872-360-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/920-264-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1060-83-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1076-164-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1152-274-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1160-19-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1300-366-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1360-150-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1360-2584-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1380-27-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1440-2478-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1520-363-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1588-188-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1784-275-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1836-361-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1976-336-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2060-200-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2308-6-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2320-236-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2332-72-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2396-337-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2440-0-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2564-359-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2756-559-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2792-55-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2796-101-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2812-254-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2848-400-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2912-379-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3036-247-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3044-234-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3148-187-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3220-239-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3220-131-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3240-148-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3360-112-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3384-194-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3428-2583-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3428-149-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3488-329-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3524-13-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3544-257-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3656-242-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3708-394-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3876-88-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3996-44-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4004-327-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4080-37-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4368-38-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4412-388-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4420-125-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4600-397-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4744-330-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4856-328-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4928-119-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4940-71-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4944-82-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4992-189-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5008-199-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5068-393-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5084-281-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5104-331-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5144-545-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5148-401-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5164-543-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5168-399-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5188-398-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5220-544-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5236-446-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5260-447-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5268-558-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5328-448-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5344-449-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5392-452-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5440-453-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5504-454-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5572-455-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5684-456-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5700-457-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5740-458-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5872-479-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5892-480-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5980-487-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5992-527-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6000-523-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6008-530-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6040-529-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6068-533-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6104-540-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6112-541-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/6140-542-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/15276-2501-0x0000000000400000-0x0000000000475000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads