0877c2614ed73c973240fa4f12cb129d9b606852c254a1dfeabd69cd29410e20

Analysis

max time kernel
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 21:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0877c2614ed73c973240fa4f12cb129d9b606852c254a1dfeabd69cd29410e20.exe
Size 184KB
Sample260912-z281csvfla
SHA256 0877c2614ed73c973240fa4f12cb129d9b606852c254a1dfeabd69cd29410e20
MD5 ae13b82e2684964f264ad397c83901cd
SHA1 62987c145278d15ee1efd22dde15760106b28679
SHA512 daaea0be951ba2d3a08ae0ed9c323acdfeabdbf81e11a5b7166a54735be2002836a54d5780f1a71849fc1bc1b0f583fc7f1953958fc9358c188bc182a53d2793
SSDEEP 3072:LTmyOAnKsRU9kx6eFXEo1b6GQ3vMqgiiuX:LTtnqm6eP1eGQ3Eqgiiu
TLSH
T14A048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3360	Unicorn-11944.exe
1424	Unicorn-2790.exe
3460	Unicorn-25903.exe
2504	Unicorn-24939.exe
2420	Unicorn-2380.exe
2044	Unicorn-4418.exe
4276	Unicorn-9157.exe
1648	Unicorn-59303.exe
1108	Unicorn-29131.exe
1520	Unicorn-14186.exe
4268	Unicorn-45468.exe
4832	Unicorn-61249.exe
4720	Unicorn-7964.exe
3924	Unicorn-24036.exe
680	Unicorn-18170.exe
3260	Unicorn-11638.exe
2708	Unicorn-42919.exe
740	Unicorn-40803.exe
2948	Unicorn-38757.exe
2988	Unicorn-26413.exe
3004	Unicorn-26413.exe
2588	Unicorn-61223.exe
3000	Unicorn-61223.exe
4356	Unicorn-18799.exe
3672	Unicorn-49526.exe
3656	Unicorn-9976.exe
1916	Unicorn-37902.exe
3488	Unicorn-12022.exe
2572	Unicorn-59085.exe
3088	Unicorn-12577.exe
4224	Unicorn-32178.exe
4464	Unicorn-43325.exe
636	Unicorn-62354.exe
3272	Unicorn-60429.exe
4652	Unicorn-27656.exe
2804	Unicorn-34363.exe
456	Unicorn-30833.exe
2268	Unicorn-55167.exe
972	Unicorn-48945.exe
4956	Unicorn-23071.exe
3892	Unicorn-11373.exe
1712	Unicorn-8680.exe
1180	Unicorn-62520.exe
4852	Unicorn-48130.exe
4236	Unicorn-63646.exe
1924	Unicorn-57689.exe
3916	Unicorn-35131.exe
2348	Unicorn-47118.exe
1624	Unicorn-27517.exe
1804	Unicorn-24825.exe
3328	Unicorn-55551.exe
4324	Unicorn-63719.exe
4572	Unicorn-45245.exe
4804	Unicorn-49329.exe
1168	Unicorn-49329.exe
3068	Unicorn-64387.exe
1708	Unicorn-29576.exe
3060	Unicorn-58820.exe
4072	Unicorn-13148.exe
1612	Unicorn-10241.exe
4920	Unicorn-15186.exe
1644	Unicorn-28093.exe
3424	Unicorn-134.exe
2000	Unicorn-39599.exe

Program crash 9 IoCs

pid	pid_target	Process	procid_target
5788	3916	WerFault.exe	134
6352	2656	WerFault.exe	182
7408	8668	WerFault.exe	402
15672	5412	WerFault.exe	210
9144	15276	WerFault.exe	768
9140	15268	WerFault.exe	767
18052	17556	WerFault.exe	1013
8892	14712	WerFault.exe	800
17756	5144	WerFault.exe	792

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63669.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21082.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9435.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54630.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44926.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35631.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2725.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8720.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-883.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31605.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45667.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1171.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62886.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28964.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25903.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8562.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45023.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42944.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13160.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29893.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63348.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64387.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64359.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52201.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9157.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37691.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29409.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19147.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18799.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36461.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64295.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52378.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39711.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1651.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39732.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59136.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59305.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6919.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8984.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59508.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51252.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28196.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6919.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50323.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61399.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2497.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25354.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54681.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-384.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3368.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25401.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29409.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11638.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36509.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51881.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41669.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
5048	0877c2614ed73c973240fa4f12cb129d9b606852c254a1dfeabd69cd29410e20.exe
3360	Unicorn-11944.exe
1424	Unicorn-2790.exe
3460	Unicorn-25903.exe
2504	Unicorn-24939.exe
2420	Unicorn-2380.exe
2044	Unicorn-4418.exe
4276	Unicorn-9157.exe
1648	Unicorn-59303.exe
1520	Unicorn-14186.exe
1108	Unicorn-29131.exe
4832	Unicorn-61249.exe
4268	Unicorn-45468.exe
3924	Unicorn-24036.exe
680	Unicorn-18170.exe
4720	Unicorn-7964.exe
3260	Unicorn-11638.exe
2708	Unicorn-42919.exe
740	Unicorn-40803.exe
2988	Unicorn-26413.exe
2948	Unicorn-38757.exe
3004	Unicorn-26413.exe
2588	Unicorn-61223.exe
3088	Unicorn-12577.exe
3488	Unicorn-12022.exe
3000	Unicorn-61223.exe
2572	Unicorn-59085.exe
3656	Unicorn-9976.exe
4356	Unicorn-18799.exe
3672	Unicorn-49526.exe
4224	Unicorn-32178.exe
1916	Unicorn-37902.exe
4464	Unicorn-43325.exe
3272	Unicorn-60429.exe
636	Unicorn-62354.exe
4652	Unicorn-27656.exe
2804	Unicorn-34363.exe
456	Unicorn-30833.exe
2268	Unicorn-55167.exe
972	Unicorn-48945.exe
4956	Unicorn-23071.exe
3892	Unicorn-11373.exe
1712	Unicorn-8680.exe
1180	Unicorn-62520.exe
4852	Unicorn-48130.exe
4236	Unicorn-63646.exe
1924	Unicorn-57689.exe
3916	Unicorn-35131.exe
3328	Unicorn-55551.exe
1624	Unicorn-27517.exe
2348	Unicorn-47118.exe
1804	Unicorn-24825.exe
4324	Unicorn-63719.exe
4572	Unicorn-45245.exe
4804	Unicorn-49329.exe
1168	Unicorn-49329.exe
3068	Unicorn-64387.exe
3060	Unicorn-58820.exe
1708	Unicorn-29576.exe
4072	Unicorn-13148.exe
4920	Unicorn-15186.exe
1644	Unicorn-28093.exe
3424	Unicorn-134.exe
1612	Unicorn-10241.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 3360	5048	0877c2614ed73c973240fa4f12cb129d9b606852c254a1dfeabd69cd29410e20.exe	88
PID 3360 wrote to memory of 1424	3360	Unicorn-11944.exe	89
PID 5048 wrote to memory of 3460	5048	0877c2614ed73c973240fa4f12cb129d9b606852c254a1dfeabd69cd29410e20.exe	90
PID 1424 wrote to memory of 2504	1424	Unicorn-2790.exe	91
PID 3460 wrote to memory of 2420	3460	Unicorn-25903.exe	92
PID 5048 wrote to memory of 2044	5048	0877c2614ed73c973240fa4f12cb129d9b606852c254a1dfeabd69cd29410e20.exe	93
PID 3360 wrote to memory of 4276	3360	Unicorn-11944.exe	94
PID 2504 wrote to memory of 1648	2504	Unicorn-24939.exe	95
PID 1424 wrote to memory of 1108	1424	Unicorn-2790.exe	96
PID 2420 wrote to memory of 1520	2420	Unicorn-2380.exe	97
PID 3460 wrote to memory of 4268	3460	Unicorn-25903.exe	98
PID 2044 wrote to memory of 4832	2044	Unicorn-4418.exe	99
PID 4276 wrote to memory of 4720	4276	Unicorn-9157.exe	100
PID 5048 wrote to memory of 3924	5048	0877c2614ed73c973240fa4f12cb129d9b606852c254a1dfeabd69cd29410e20.exe	101
PID 3360 wrote to memory of 680	3360	Unicorn-11944.exe	102
PID 1648 wrote to memory of 3260	1648	Unicorn-59303.exe	103
PID 2504 wrote to memory of 2708	2504	Unicorn-24939.exe	104
PID 1108 wrote to memory of 740	1108	Unicorn-29131.exe	105
PID 1424 wrote to memory of 2948	1424	Unicorn-2790.exe	106
PID 4832 wrote to memory of 2988	4832	Unicorn-61249.exe	108
PID 1520 wrote to memory of 3004	1520	Unicorn-14186.exe	107
PID 4268 wrote to memory of 3000	4268	Unicorn-45468.exe	110
PID 3924 wrote to memory of 2588	3924	Unicorn-24036.exe	109
PID 2044 wrote to memory of 4356	2044	Unicorn-4418.exe	111
PID 2420 wrote to memory of 3672	2420	Unicorn-2380.exe	112
PID 3460 wrote to memory of 3656	3460	Unicorn-25903.exe	113
PID 5048 wrote to memory of 1916	5048	0877c2614ed73c973240fa4f12cb129d9b606852c254a1dfeabd69cd29410e20.exe	114
PID 4720 wrote to memory of 3488	4720	Unicorn-7964.exe	115
PID 680 wrote to memory of 2572	680	Unicorn-18170.exe	116
PID 4276 wrote to memory of 3088	4276	Unicorn-9157.exe	117
PID 3360 wrote to memory of 4224	3360	Unicorn-11944.exe	118
PID 3260 wrote to memory of 4464	3260	Unicorn-11638.exe	119
PID 1648 wrote to memory of 636	1648	Unicorn-59303.exe	120
PID 2708 wrote to memory of 3272	2708	Unicorn-42919.exe	121
PID 2504 wrote to memory of 4652	2504	Unicorn-24939.exe	122
PID 740 wrote to memory of 2804	740	Unicorn-40803.exe	123
PID 1108 wrote to memory of 456	1108	Unicorn-29131.exe	124
PID 2588 wrote to memory of 2268	2588	Unicorn-61223.exe	125
PID 2988 wrote to memory of 972	2988	Unicorn-26413.exe	126
PID 3004 wrote to memory of 4956	3004	Unicorn-26413.exe	127
PID 3924 wrote to memory of 3892	3924	Unicorn-24036.exe	128
PID 2948 wrote to memory of 1712	2948	Unicorn-38757.exe	129
PID 1520 wrote to memory of 1180	1520	Unicorn-14186.exe	130
PID 4832 wrote to memory of 4852	4832	Unicorn-61249.exe	131
PID 1424 wrote to memory of 4236	1424	Unicorn-2790.exe	132
PID 3488 wrote to memory of 1924	3488	Unicorn-12022.exe	133
PID 3656 wrote to memory of 3916	3656	Unicorn-9976.exe	134
PID 3460 wrote to memory of 2348	3460	Unicorn-25903.exe	135
PID 4720 wrote to memory of 1624	4720	Unicorn-7964.exe	136
PID 1916 wrote to memory of 1804	1916	Unicorn-37902.exe	137
PID 3088 wrote to memory of 3328	3088	Unicorn-12577.exe	138
PID 4356 wrote to memory of 4324	4356	Unicorn-18799.exe	139
PID 4224 wrote to memory of 4572	4224	Unicorn-32178.exe	140
PID 2572 wrote to memory of 4804	2572	Unicorn-59085.exe	142
PID 3672 wrote to memory of 1168	3672	Unicorn-49526.exe	141
PID 4276 wrote to memory of 3068	4276	Unicorn-9157.exe	143
PID 2044 wrote to memory of 1708	2044	Unicorn-4418.exe	144
PID 680 wrote to memory of 3060	680	Unicorn-18170.exe	147
PID 3000 wrote to memory of 4072	3000	Unicorn-61223.exe	146
PID 5048 wrote to memory of 1612	5048	0877c2614ed73c973240fa4f12cb129d9b606852c254a1dfeabd69cd29410e20.exe	145
PID 2420 wrote to memory of 4920	2420	Unicorn-2380.exe	148
PID 4268 wrote to memory of 1644	4268	Unicorn-45468.exe	149
PID 3360 wrote to memory of 3424	3360	Unicorn-11944.exe	150
PID 4652 wrote to memory of 2000	4652	Unicorn-27656.exe	151

C:\Users\Admin\AppData\Local\Temp\0877c2614ed73c973240fa4f12cb129d9b606852c254a1dfeabd69cd29410e20.exe
"C:\Users\Admin\AppData\Local\Temp\0877c2614ed73c973240fa4f12cb129d9b606852c254a1dfeabd69cd29410e20.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11944.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11944.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2790.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2790.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24939.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59303.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11638.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43325.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47767.exe
        8⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
        9⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29893.exe
        10⤵
        
        PID:7988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13073.exe
        10⤵
        
        PID:10304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1998.exe
        10⤵
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6919.exe
        10⤵
        
        PID:15596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21082.exe
        10⤵
        
        PID:16484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54630.exe
        9⤵
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44926.exe
        9⤵
        
        PID:10520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-568.exe
        9⤵
        
        PID:12608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38739.exe
        9⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60699.exe
        9⤵
        
        PID:17024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60364.exe
        8⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64781.exe
        9⤵
        
        PID:11912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60406.exe
        9⤵
        
        PID:14060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17390.exe
        9⤵
        
        PID:16008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60474.exe
        9⤵
        
        PID:16548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44821.exe
        8⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49804.exe
        8⤵
        
        PID:10636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60869.exe
        8⤵
        
        PID:12452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62886.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39765.exe
        8⤵
        
        PID:17012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13511.exe
        7⤵
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39991.exe
        8⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37625.exe
        9⤵
        
        PID:11104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48372.exe
        9⤵
        
        PID:13104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16684.exe
        9⤵
        
        PID:14416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34278.exe
        9⤵
        
        PID:17228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54630.exe
        8⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44926.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35378.exe
        8⤵
        
        PID:12972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32709.exe
        8⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38141.exe
        8⤵
        
        PID:17104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8562.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43977.exe
        8⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60344.exe
        8⤵
        
        PID:13352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28848.exe
        8⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21745.exe
        8⤵
        
        PID:17892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50686.exe
        7⤵
        
        PID:7880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41139.exe
        7⤵
        
        PID:10680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44333.exe
        7⤵
        
        PID:1036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48649.exe
        7⤵
        
        PID:15156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41368.exe
        7⤵
        
        PID:17120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62354.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51851.exe
        7⤵
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4412.exe
        8⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29893.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26093.exe
        9⤵
        
        PID:8928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61313.exe
        9⤵
        
        PID:13400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6919.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:15636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11352.exe
        9⤵
        
        PID:16728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33825.exe
        8⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-384.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14303.exe
        8⤵
        
        PID:13288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27506.exe
        8⤵
        
        PID:14636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53426.exe
        8⤵
        
        PID:17032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26539.exe
        7⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6514.exe
        8⤵
        
        PID:10440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49934.exe
        8⤵
        
        PID:11168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28360.exe
        8⤵
        
        PID:15168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39732.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2828.exe
        7⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6249.exe
        7⤵
        
        PID:8680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28196.exe
        7⤵
        
        PID:13080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56280.exe
        7⤵
        
        PID:14980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60377.exe
        7⤵
        
        PID:16708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4688.exe
        6⤵
        
        PID:116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31605.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38995.exe
        8⤵
        
        PID:9376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10079.exe
        8⤵
        
        PID:12728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31676.exe
        8⤵
        
        PID:14704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27698.exe
        8⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45092.exe
        7⤵
        
        PID:8036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62797.exe
        7⤵
        
        PID:11204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18771.exe
        7⤵
        
        PID:11376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34304.exe
        7⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14531.exe
        7⤵
        
        PID:16876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40878.exe
        6⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34979.exe
        7⤵
        
        PID:15716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46773.exe
        7⤵
        
        PID:10888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11102.exe
        6⤵
        
        PID:7992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45023.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10060.exe
        6⤵
        
        PID:12804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58420.exe
        6⤵
        
        PID:14748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64814.exe
        6⤵
        
        PID:17172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42919.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60429.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51851.exe
        7⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22223.exe
        8⤵
        
        PID:820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10219.exe
        8⤵
        
        PID:8272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9669.exe
        8⤵
        
        PID:11880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56505.exe
        8⤵
        
        PID:14008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32071.exe
        8⤵
        
        PID:16128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57206.exe
        8⤵
        
        PID:17792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15900.exe
        7⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25887.exe
        8⤵
        
        PID:12104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60406.exe
        8⤵
        
        PID:14028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52201.exe
        8⤵
        
        PID:15980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29748.exe
        8⤵
        
        PID:16496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27298.exe
        7⤵
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37028.exe
        7⤵
        
        PID:8672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56368.exe
        7⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64321.exe
        7⤵
        
        PID:15556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30808.exe
        7⤵
        
        PID:8844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21679.exe
        6⤵
        
        PID:32
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46405.exe
        7⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2326.exe
        8⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29409.exe
        8⤵
        
        PID:10348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3368.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57910.exe
        8⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39749.exe
        8⤵
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54630.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44926.exe
        7⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-568.exe
        7⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34655.exe
        7⤵
        
        PID:14712
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14712 -s 464
        8⤵
        Program crash
        
        PID:8892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17720.exe
        7⤵
        
        PID:17096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32490.exe
        6⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51055.exe
        7⤵
        
        PID:9220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52674.exe
        7⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8734.exe
        7⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6893.exe
        7⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34076.exe
        7⤵
        
        PID:18332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55756.exe
        6⤵
        
        PID:7624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63121.exe
        6⤵
        
        PID:9364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11661.exe
        6⤵
        
        PID:13040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28037.exe
        6⤵
        
        PID:15268
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15268 -s 464
        7⤵
        Program crash
        
        PID:9140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40792.exe
        6⤵
        
        PID:16956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27656.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39599.exe
        6⤵
        Executes dropped EXE
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13348.exe
        7⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22747.exe
        8⤵
        
        PID:7344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64220.exe
        8⤵
        
        PID:10740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38179.exe
        8⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4625.exe
        8⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33526.exe
        8⤵
        
        PID:17180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36155.exe
        7⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-384.exe
        7⤵
        
        PID:10332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14303.exe
        7⤵
        
        PID:13260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9224.exe
        7⤵
        
        PID:15124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11023.exe
        7⤵
        
        PID:17108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15900.exe
        6⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45767.exe
        7⤵
        
        PID:11564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47053.exe
        7⤵
        
        PID:13552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22462.exe
        7⤵
        
        PID:15900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15045.exe
        6⤵
        
        PID:7452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37028.exe
        6⤵
        
        PID:2560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50146.exe
        6⤵
        
        PID:13524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49931.exe
        6⤵
        
        PID:15860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26724.exe
        6⤵
        
        PID:16576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33112.exe
        5⤵
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58055.exe
        6⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38803.exe
        7⤵
        
        PID:7872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3665.exe
        7⤵
        
        PID:1272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64157.exe
        7⤵
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58232.exe
        7⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65467.exe
        7⤵
        
        PID:7552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11049.exe
        6⤵
        
        PID:7380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43145.exe
        6⤵
        
        PID:10452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9233.exe
        6⤵
        
        PID:3392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        6⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58024.exe
        6⤵
        
        PID:16756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5762.exe
        5⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59799.exe
        6⤵
        
        PID:10096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17261.exe
        6⤵
        
        PID:13064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10078.exe
        6⤵
        
        PID:15048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50038.exe
        6⤵
        
        PID:16760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25485.exe
        5⤵
        
        PID:7852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41669.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39868.exe
        5⤵
        
        PID:12560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1171.exe
        5⤵
        
        PID:15208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40233.exe
        5⤵
        
        PID:17148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29131.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40803.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34363.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50349.exe
        7⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57095.exe
        8⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9513.exe
        8⤵
        
        PID:7684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-384.exe
        8⤵
        
        PID:10160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36862.exe
        8⤵
        
        PID:13032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7278.exe
        8⤵
        
        PID:14960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43311.exe
        8⤵
        
        PID:16660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23415.exe
        7⤵
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49851.exe
        8⤵
        
        PID:11584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44070.exe
        8⤵
        
        PID:13956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52201.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3105.exe
        8⤵
        
        PID:8876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11956.exe
        7⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49804.exe
        7⤵
        
        PID:10656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60869.exe
        7⤵
        
        PID:12468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10971.exe
        7⤵
        
        PID:15316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62899.exe
        7⤵
        
        PID:17160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3841.exe
        6⤵
        
        PID:932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19571.exe
        7⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40199.exe
        8⤵
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13073.exe
        8⤵
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44977.exe
        8⤵
        
        PID:13332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6919.exe
        8⤵
        
        PID:15720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21082.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54630.exe
        7⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43363.exe
        7⤵
        
        PID:10280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14303.exe
        7⤵
        
        PID:13300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27506.exe
        7⤵
        
        PID:15188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45257.exe
        7⤵
        
        PID:16904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2340.exe
        6⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60697.exe
        7⤵
        
        PID:11944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60406.exe
        7⤵
        
        PID:14120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52201.exe
        7⤵
        
        PID:15848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60474.exe
        7⤵
        
        PID:9004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42326.exe
        6⤵
        
        PID:7940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41139.exe
        6⤵
        
        PID:10664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44333.exe
        6⤵
        
        PID:12380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28037.exe
        6⤵
        
        PID:15276
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15276 -s 464
        7⤵
        Program crash
        
        PID:9144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10066.exe
        6⤵
        
        PID:16828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30833.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23707.exe
        6⤵
        
        PID:396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47365.exe
        7⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45793.exe
        8⤵
        
        PID:11172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64708.exe
        8⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37105.exe
        8⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39732.exe
        8⤵
        
        PID:16868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34977.exe
        7⤵
        
        PID:7960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64359.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18195.exe
        7⤵
        
        PID:12716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13884.exe
        7⤵
        
        PID:14524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11023.exe
        7⤵
        
        PID:17196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43836.exe
        6⤵
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48713.exe
        6⤵
        
        PID:7964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16939.exe
        6⤵
        
        PID:10968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34034.exe
        6⤵
        
        PID:12952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62886.exe
        6⤵
        
        PID:14384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26143.exe
        6⤵
        
        PID:17140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25744.exe
        5⤵
        
        PID:2780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22223.exe
        6⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8720.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10219.exe
        6⤵
        
        PID:8280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9669.exe
        6⤵
        
        PID:11932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56505.exe
        6⤵
        
        PID:14080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32071.exe
        6⤵
        
        PID:15888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8950.exe
        6⤵
        
        PID:17848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6067.exe
        5⤵
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27593.exe
        6⤵
        
        PID:12116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59305.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26546.exe
        6⤵
        
        PID:15704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61672.exe
        6⤵
        
        PID:17816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11102.exe
        5⤵
        
        PID:7996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45023.exe
        5⤵
        
        PID:10928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10060.exe
        5⤵
        
        PID:12812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14674.exe
        5⤵
        
        PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1223.exe
        5⤵
        
        PID:17236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38757.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38757.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8680.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50323.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34859.exe
        7⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47744.exe
        7⤵
        
        PID:8564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45667.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6301.exe
        7⤵
        
        PID:13920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13220.exe
        7⤵
        
        PID:16172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29819.exe
        7⤵
        
        PID:8944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64194.exe
        6⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54681.exe
        6⤵
        
        PID:8816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61008.exe
        6⤵
        
        PID:11688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10594.exe
        6⤵
        
        PID:14512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28755.exe
        6⤵
        
        PID:6856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10229.exe
        5⤵
        
        PID:2640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3748.exe
        6⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51252.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37691.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20115.exe
        6⤵
        
        PID:13320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63791.exe
        6⤵
        
        PID:15604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35273.exe
        6⤵
        
        PID:16540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64115.exe
        5⤵
        
        PID:6280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38564.exe
        5⤵
        
        PID:8608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25124.exe
        5⤵
        
        PID:12008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54806.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54015.exe
        5⤵
        
        PID:16120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25354.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63646.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-883.exe
        5⤵
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64189.exe
        6⤵
        
        PID:7768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58984.exe
        6⤵
        
        PID:10528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63669.exe
        6⤵
        
        PID:12292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36172.exe
        6⤵
        
        PID:15248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39235.exe
        6⤵
        
        PID:17088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39518.exe
        6⤵
        
        PID:17940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13160.exe
        5⤵
        
        PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5673.exe
        5⤵
        
        PID:9268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2156.exe
        5⤵
        
        PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4365.exe
        5⤵
        
        PID:14492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31623.exe
        5⤵
        
        PID:1436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33224.exe
      4⤵
      PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43795.exe
        5⤵
        
        PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8081.exe
        5⤵
        
        PID:8488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29330.exe
        5⤵
        
        PID:11556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63670.exe
        5⤵
        
        PID:13936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49401.exe
        5⤵
        
        PID:15904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60546.exe
        5⤵
        
        PID:8424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28251.exe
      4⤵
      PID:6404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46765.exe
      4⤵
      PID:8660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51186.exe
      4⤵
      PID:12064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45005.exe
      4⤵
      PID:14084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57992.exe
      4⤵
      PID:16372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28964.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:17572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9157.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9157.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7964.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57689.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36317.exe
        7⤵
        
        PID:492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22223.exe
        8⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40945.exe
        8⤵
        
        PID:8356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9669.exe
        8⤵
        
        PID:11956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56505.exe
        8⤵
        
        PID:14148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32071.exe
        8⤵
        
        PID:15912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57206.exe
        8⤵
        
        PID:10224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5455.exe
        7⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61479.exe
        7⤵
        
        PID:8572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51532.exe
        7⤵
        
        PID:11860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63173.exe
        7⤵
        
        PID:13912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62222.exe
        7⤵
        
        PID:16184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42801.exe
        7⤵
        
        PID:16952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57676.exe
        6⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47687.exe
        7⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23736.exe
        7⤵
        
        PID:8100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60214.exe
        7⤵
        
        PID:11288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49105.exe
        7⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50738.exe
        7⤵
        
        PID:7104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24454.exe
        6⤵
        
        PID:7060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28310.exe
        6⤵
        
        PID:10340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54640.exe
        6⤵
        
        PID:13280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54679.exe
        6⤵
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18234.exe
        6⤵
        
        PID:17076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27517.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24065.exe
        6⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32145.exe
        7⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23749.exe
        8⤵
        
        PID:12184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58128.exe
        8⤵
        
        PID:11244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20218.exe
        8⤵
        
        PID:388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34714.exe
        8⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24801.exe
        7⤵
        
        PID:7660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39829.exe
        7⤵
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7863.exe
        7⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63791.exe
        7⤵
        
        PID:15572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8631.exe
        7⤵
        
        PID:8880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24426.exe
        6⤵
        
        PID:7048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49036.exe
        6⤵
        
        PID:8616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25290.exe
        6⤵
        
        PID:12472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41121.exe
        6⤵
        
        PID:14640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19562.exe
        6⤵
        
        PID:6912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38547.exe
        5⤵
        
        PID:3788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5388.exe
        6⤵
        
        PID:8012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15403.exe
        6⤵
        
        PID:10268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46539.exe
        6⤵
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35160.exe
        6⤵
        
        PID:15420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11544.exe
        6⤵
        
        PID:16808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29332.exe
        5⤵
        
        PID:6916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54761.exe
        5⤵
        
        PID:8520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2725.exe
        5⤵
        
        PID:3440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-434.exe
        5⤵
        
        PID:632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6008.exe
        5⤵
        
        PID:7148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12577.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55551.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5590.exe
        6⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13068.exe
        7⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40945.exe
        7⤵
        
        PID:8328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49943.exe
        7⤵
        
        PID:11316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5725.exe
        7⤵
        
        PID:13644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45317.exe
        7⤵
        
        PID:15940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52378.exe
        7⤵
        
        PID:16656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3317.exe
        6⤵
        
        PID:6304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32698.exe
        6⤵
        
        PID:8596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33790.exe
        6⤵
        
        PID:12024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5804.exe
        6⤵
        
        PID:14112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63592.exe
        6⤵
        
        PID:16040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56423.exe
        6⤵
        
        PID:8888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26949.exe
        5⤵
        
        PID:5040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4106.exe
        6⤵
        
        PID:6652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39061.exe
        6⤵
        
        PID:10544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9233.exe
        6⤵
        
        PID:2060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        6⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-655.exe
        6⤵
        
        PID:17208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23466.exe
        5⤵
        
        PID:6552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29602.exe
        5⤵
        
        PID:8708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51549.exe
        5⤵
        
        PID:11308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32569.exe
        5⤵
        
        PID:2760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23854.exe
        5⤵
        
        PID:7924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64387.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36509.exe
        5⤵
        
        PID:1224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48341.exe
        6⤵
        
        PID:7412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8133.exe
        6⤵
        
        PID:12640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23508.exe
        6⤵
        
        PID:14720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13307.exe
        6⤵
        
        PID:6756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65187.exe
        6⤵
        
        PID:9344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9731.exe
        5⤵
        
        PID:6588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63399.exe
        5⤵
        
        PID:8396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23266.exe
        5⤵
        
        PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22270.exe
        5⤵
        
        PID:14432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61620.exe
        5⤵
        
        PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46859.exe
        5⤵
        
        PID:18344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44988.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41605.exe
        5⤵
        
        PID:7648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-437.exe
        5⤵
        
        PID:11184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37568.exe
        5⤵
        
        PID:13504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38108.exe
        5⤵
        
        PID:6464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3753.exe
        5⤵
        
        PID:17808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4906.exe
      4⤵
      PID:6740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19175.exe
      4⤵
      PID:10120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19790.exe
      4⤵
      PID:220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27912.exe
      4⤵
      PID:4872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19147.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20301.exe
      4⤵
      PID:18088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18170.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18170.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59085.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49329.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52653.exe
        6⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-624.exe
        7⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1946.exe
        7⤵
        
        PID:8296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23266.exe
        7⤵
        
        PID:12188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51051.exe
        7⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43529.exe
        7⤵
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25875.exe
        6⤵
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61479.exe
        6⤵
        
        PID:8532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51278.exe
        6⤵
        
        PID:12184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7304.exe
        6⤵
        
        PID:2100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9513.exe
        6⤵
        
        PID:16320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25110.exe
        6⤵
        
        PID:10564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53592.exe
        5⤵
        
        PID:1872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51361.exe
        6⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17375.exe
        6⤵
        
        PID:10392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8438.exe
        6⤵
        
        PID:13268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62814.exe
        6⤵
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26982.exe
        6⤵
        
        PID:16940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63348.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28310.exe
        5⤵
        
        PID:8252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11661.exe
        5⤵
        
        PID:13044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7808.exe
        5⤵
        
        PID:14972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38846.exe
        5⤵
        
        PID:16720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58820.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36509.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53717.exe
        6⤵
        
        PID:6396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35299.exe
        6⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8668 -s 220
        7⤵
        Program crash
        
        PID:7408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59673.exe
        6⤵
        
        PID:9460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20115.exe
        6⤵
        
        PID:13360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63791.exe
        6⤵
        
        PID:15692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52378.exe
        6⤵
        
        PID:16716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24618.exe
        5⤵
        
        PID:6436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6249.exe
        5⤵
        
        PID:8604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28196.exe
        5⤵
        
        PID:13096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11163.exe
        5⤵
        
        PID:15076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62323.exe
        5⤵
        
        PID:16892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18510.exe
      4⤵
      PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31351.exe
        5⤵
        
        PID:6324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18963.exe
        5⤵
        
        PID:8624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27924.exe
        5⤵
        
        PID:11988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14469.exe
        5⤵
        
        PID:14072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49401.exe
        5⤵
        
        PID:15916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21651.exe
        5⤵
        
        PID:16692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62580.exe
      4⤵
      PID:6804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24034.exe
      4⤵
      PID:8196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2725.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58187.exe
      4⤵
      PID:14656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63569.exe
      4⤵
      PID:7128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32178.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32178.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45245.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59835.exe
        5⤵
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18191.exe
        6⤵
        
        PID:10144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20577.exe
        6⤵
        
        PID:12388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8734.exe
        6⤵
        
        PID:14448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16623.exe
        6⤵
        
        PID:15688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8745.exe
        5⤵
        
        PID:6956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44926.exe
        5⤵
        
        PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35378.exe
        5⤵
        
        PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44961.exe
        5⤵
        
        PID:7256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17720.exe
        5⤵
        
        PID:16884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30239.exe
      4⤵
      PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3250.exe
        5⤵
        
        PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13073.exe
        5⤵
        
        PID:10688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1998.exe
        5⤵
        
        PID:5044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49898.exe
        5⤵
        
        PID:15768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16998.exe
        5⤵
        
        PID:9036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13134.exe
      4⤵
      PID:7516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6249.exe
      4⤵
      PID:9240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28196.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56280.exe
      4⤵
      PID:14948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60377.exe
      4⤵
      PID:16700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61696.exe
      4⤵
      PID:17912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-134.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-134.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53229.exe
      4⤵
      PID:5224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57085.exe
        5⤵
        
        PID:9404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47220.exe
        5⤵
        
        PID:12300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19040.exe
        5⤵
        
        PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16623.exe
        5⤵
        
        PID:6776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62857.exe
        5⤵
        
        PID:18140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47064.exe
      4⤵
      PID:6860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26834.exe
      4⤵
      PID:9120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27926.exe
      4⤵
      PID:11416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16240.exe
      4⤵
      PID:13840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14557.exe
      4⤵
      PID:6172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11811.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11811.exe
    3⤵
    PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17293.exe
      4⤵
      PID:7444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33231.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33231.exe
    3⤵
    PID:5728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19562.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19562.exe
    3⤵
    PID:10292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44839.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44839.exe
    3⤵
    PID:13056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50679.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50679.exe
    3⤵
    PID:15004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9975.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9975.exe
    3⤵
    PID:16680
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25903.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25903.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2380.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2380.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14186.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26413.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23071.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35741.exe
        7⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8984.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23736.exe
        8⤵
        
        PID:8220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60214.exe
        8⤵
        
        PID:11508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45021.exe
        8⤵
        
        PID:13516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22826.exe
        8⤵
        
        PID:8140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48355.exe
        7⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38777.exe
        8⤵
        
        PID:11132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6353.exe
        8⤵
        
        PID:12996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29294.exe
        8⤵
        
        PID:15432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17879.exe
        8⤵
        
        PID:9108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63426.exe
        7⤵
        
        PID:8496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19260.exe
        7⤵
        
        PID:12412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41121.exe
        7⤵
        
        PID:14648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54373.exe
        7⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57676.exe
        6⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38917.exe
        7⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39061.exe
        7⤵
        
        PID:10536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9233.exe
        7⤵
        
        PID:12100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
        7⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-655.exe
        7⤵
        
        PID:16900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe
        6⤵
        
        PID:6484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62466.exe
        6⤵
        
        PID:8112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63225.exe
        6⤵
        
        PID:11380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55128.exe
        6⤵
        
        PID:3300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25401.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62520.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-883.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4132.exe
        7⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10219.exe
        7⤵
        
        PID:8256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9669.exe
        7⤵
        
        PID:11892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56505.exe
        7⤵
        
        PID:14068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36155.exe
        7⤵
        
        PID:16000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37923.exe
        7⤵
        
        PID:17944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13160.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1589.exe
        6⤵
        
        PID:9280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58155.exe
        6⤵
        
        PID:1620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36461.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50097.exe
        6⤵
        
        PID:7056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57021.exe
        5⤵
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39711.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47744.exe
        6⤵
        
        PID:8540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45667.exe
        6⤵
        
        PID:11808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6301.exe
        6⤵
        
        PID:13880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49401.exe
        6⤵
        
        PID:16156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52762.exe
        6⤵
        
        PID:17556
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 17556 -s 276
        7⤵
        Program crash
        
        PID:18052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29332.exe
        5⤵
        
        PID:6564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27734.exe
        5⤵
        
        PID:9368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41619.exe
        5⤵
        
        PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61887.exe
        5⤵
        
        PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28566.exe
        5⤵
        
        PID:6092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50719.exe
        5⤵
        
        PID:18308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49526.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49329.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44485.exe
        6⤵
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48.exe
        7⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18387.exe
        7⤵
        
        PID:8400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23300.exe
        7⤵
        
        PID:11392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9809.exe
        7⤵
        
        PID:13536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49401.exe
        7⤵
        
        PID:15880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39357.exe
        7⤵
        
        PID:17072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56602.exe
        6⤵
        
        PID:6256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32698.exe
        6⤵
        
        PID:8644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33790.exe
        6⤵
        
        PID:12000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5804.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32865.exe
        6⤵
        
        PID:16332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46885.exe
        6⤵
        
        PID:17168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exe
        5⤵
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4272.exe
        6⤵
        
        PID:7440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29409.exe
        6⤵
        
        PID:10400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3368.exe
        6⤵
        
        PID:1880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28746.exe
        6⤵
        
        PID:7304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10968.exe
        6⤵
        
        PID:8440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31634.exe
        5⤵
        
        PID:6628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38346.exe
        5⤵
        
        PID:9444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2156.exe
        5⤵
        
        PID:6648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1651.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64295.exe
        5⤵
        
        PID:16016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23382.exe
        5⤵
        
        PID:18192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15186.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6742.exe
        5⤵
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22747.exe
        6⤵
        
        PID:7336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29409.exe
        6⤵
        
        PID:10416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3368.exe
        6⤵
        
        PID:1164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42944.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45779.exe
        6⤵
        
        PID:7744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47832.exe
        5⤵
        
        PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31110.exe
        5⤵
        
        PID:10724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5943.exe
        5⤵
        
        PID:12600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13884.exe
        5⤵
        
        PID:14696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58561.exe
        5⤵
        
        PID:7784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38958.exe
      4⤵
      PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29893.exe
        5⤵
        
        PID:8032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35631.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10166.exe
        5⤵
        
        PID:2152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6919.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55893.exe
        5⤵
        
        PID:8884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9950.exe
      4⤵
      PID:7216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11775.exe
      4⤵
      PID:10568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61399.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6506.exe
      4⤵
      PID:15308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4731.exe
      4⤵
      PID:16840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45468.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45468.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61223.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13148.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63727.exe
        6⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33681.exe
        7⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20883.exe
        7⤵
        
        PID:9292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60955.exe
        7⤵
        
        PID:12308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25482.exe
        7⤵
        
        PID:14480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31092.exe
        7⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25901.exe
        7⤵
        
        PID:18096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59508.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38511.exe
        6⤵
        
        PID:10112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27926.exe
        6⤵
        
        PID:4416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5934.exe
        6⤵
        
        PID:13492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
        6⤵
        
        PID:6844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1267.exe
        5⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4656.exe
        6⤵
        
        PID:7980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15403.exe
        6⤵
        
        PID:8364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65013.exe
        6⤵
        
        PID:3964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-349.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47725.exe
        6⤵
        
        PID:16520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13544.exe
        5⤵
        
        PID:6960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32700.exe
        5⤵
        
        PID:9228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19260.exe
        5⤵
        
        PID:11552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48905.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64295.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28093.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56737.exe
        5⤵
        
        PID:4408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50956.exe
        6⤵
        
        PID:6996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61645.exe
        6⤵
        
        PID:7776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33956.exe
        6⤵
        
        PID:12484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57657.exe
        6⤵
        
        PID:14624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2497.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3317.exe
        5⤵
        
        PID:6296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32698.exe
        5⤵
        
        PID:8636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33790.exe
        5⤵
        
        PID:12016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5804.exe
        5⤵
        
        PID:14092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63592.exe
        5⤵
        
        PID:15992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52339.exe
        5⤵
        
        PID:16508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50799.exe
      4⤵
      PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39711.exe
        5⤵
        
        PID:5828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47744.exe
        5⤵
        
        PID:8524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45667.exe
        5⤵
        
        PID:11836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6301.exe
        5⤵
        
        PID:13900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14590.exe
        5⤵
        
        PID:16048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52378.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37500.exe
      4⤵
      PID:6620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29872.exe
      4⤵
      PID:8480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63602.exe
      4⤵
      PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29023.exe
      4⤵
      PID:4688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16506.exe
      4⤵
      PID:7140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9976.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9976.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35131.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3916
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 628
        5⤵
        Program crash
        
        PID:5788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5159.exe
      4⤵
      PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40085.exe
        5⤵
        
        PID:12252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17235.exe
        5⤵
        
        PID:14168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21474.exe
        5⤵
        
        PID:15816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16125.exe
        5⤵
        
        PID:8840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22480.exe
      4⤵
      PID:6584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36976.exe
      4⤵
      PID:10352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28196.exe
      4⤵
      PID:13000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56280.exe
      4⤵
      PID:15036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11176.exe
      4⤵
      PID:16776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2360.exe
      4⤵
      PID:10796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47118.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47118.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9435.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47355.exe
        5⤵
        
        PID:7796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8325.exe
        5⤵
        
        PID:1064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64157.exe
        5⤵
        
        PID:3572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39758.exe
        5⤵
        
        PID:7100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13544.exe
      4⤵
      PID:7160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65139.exe
        5⤵
        
        PID:12892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16187.exe
        5⤵
        
        PID:14880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31536.exe
        5⤵
        
        PID:16628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21335.exe
        5⤵
        
        PID:10188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6249.exe
      4⤵
      PID:9264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28196.exe
      4⤵
      PID:13072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56280.exe
      4⤵
      PID:14988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61727.exe
      4⤵
      PID:16924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11242.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11242.exe
    3⤵
    PID:364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13556.exe
      4⤵
      PID:8072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13073.exe
      4⤵
      PID:10264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30586.exe
      4⤵
      PID:13388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6919.exe
      4⤵
      PID:15644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47725.exe
      4⤵
      PID:9056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4131.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4131.exe
    3⤵
    PID:6540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26319.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26319.exe
    3⤵
    PID:8268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59136.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59136.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22577.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22577.exe
    3⤵
    PID:13628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41629.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41629.exe
    3⤵
    PID:5956
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4418.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4418.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61249.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61249.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26413.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48945.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36919.exe
        6⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56649.exe
        7⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39545.exe
        8⤵
        
        PID:11820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52238.exe
        8⤵
        
        PID:13892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17390.exe
        8⤵
        
        PID:16032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33832.exe
        8⤵
        
        PID:8864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20525.exe
        7⤵
        
        PID:8240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50702.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37018.exe
        7⤵
        
        PID:14684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46793.exe
        7⤵
        
        PID:16528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28999.exe
        6⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42223.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27541.exe
        7⤵
        
        PID:14200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52201.exe
        7⤵
        
        PID:15868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64558.exe
        7⤵
        
        PID:16624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54681.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29166.exe
        6⤵
        
        PID:11384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54429.exe
        6⤵
        
        PID:13424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24697.exe
        6⤵
        
        PID:15740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52339.exe
        6⤵
        
        PID:8804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42709.exe
        5⤵
        
        PID:4896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39711.exe
        6⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47744.exe
        6⤵
        
        PID:8556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45667.exe
        6⤵
        
        PID:11828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6301.exe
        6⤵
        
        PID:13872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14590.exe
        6⤵
        
        PID:15928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52378.exe
        6⤵
        
        PID:9160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12392.exe
        5⤵
        
        PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60546.exe
        5⤵
        
        PID:8372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20500.exe
        5⤵
        
        PID:11400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15335.exe
        5⤵
        
        PID:13484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6952.exe
        5⤵
        
        PID:15892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-82.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-82.exe
        5⤵
        
        PID:9024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48130.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19981.exe
        5⤵
        
        PID:4564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34859.exe
        6⤵
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40841.exe
        6⤵
        
        PID:9064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23266.exe
        6⤵
        
        PID:4560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42883.exe
        6⤵
        
        PID:13580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47229.exe
        6⤵
        
        PID:16228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12624.exe
        6⤵
        
        PID:4160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23929.exe
        5⤵
        
        PID:2252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21816.exe
        5⤵
        
        PID:8468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-385.exe
        5⤵
        
        PID:11692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55005.exe
        5⤵
        
        PID:13844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28781.exe
        5⤵
        
        PID:16132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7990.exe
        5⤵
        
        PID:7764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36601.exe
      4⤵
      PID:4748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22747.exe
        5⤵
        
        PID:7428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29409.exe
        5⤵
        
        PID:10384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3368.exe
        5⤵
        
        PID:12576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4625.exe
        5⤵
        
        PID:4068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60169.exe
        5⤵
        
        PID:16988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35554.exe
      4⤵
      PID:6508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55747.exe
      4⤵
      PID:6252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35013.exe
      4⤵
      PID:11676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6464.exe
      4⤵
      PID:13584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11462.exe
      4⤵
      PID:7120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19993.exe
      4⤵
      PID:18376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18799.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18799.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63719.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4220.exe
        5⤵
        
        PID:528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39711.exe
        6⤵
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40945.exe
        6⤵
        
        PID:8348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9669.exe
        6⤵
        
        PID:11940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56505.exe
        6⤵
        
        PID:14024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32071.exe
        6⤵
        
        PID:15936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35224.exe
        6⤵
        
        PID:10784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42979.exe
        5⤵
        
        PID:6816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49275.exe
        6⤵
        
        PID:2900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24443.exe
        6⤵
        
        PID:12836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25402.exe
        6⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5144 -s 464
        7⤵
        Program crash
        
        PID:17756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46276.exe
        6⤵
        
        PID:17052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26834.exe
        5⤵
        
        PID:7240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27926.exe
        5⤵
        
        PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5934.exe
        5⤵
        
        PID:912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26233.exe
        5⤵
        
        PID:6768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63387.exe
        5⤵
        
        PID:18124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33939.exe
      4⤵
      PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19587.exe
        5⤵
        
        PID:7356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54682.exe
        5⤵
        
        PID:1124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3944.exe
        5⤵
        
        PID:13464
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5412 -s 744
        5⤵
        Program crash
        
        PID:15672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49898.exe
        5⤵
        
        PID:9256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24618.exe
      4⤵
      PID:6828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6249.exe
      4⤵
      PID:8172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28196.exe
      4⤵
      PID:13088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56280.exe
      4⤵
      PID:14940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12526.exe
      4⤵
      PID:17136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29576.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29576.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65289.exe
      4⤵
      PID:2656
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 632
        5⤵
        Program crash
        
        PID:6352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3125.exe
      4⤵
      PID:6444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61287.exe
      4⤵
      PID:8712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5009.exe
      4⤵
      PID:12168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28170.exe
      4⤵
      PID:14188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20613.exe
      4⤵
      PID:15836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52339.exe
      4⤵
      PID:16568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44988.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44988.exe
    3⤵
    PID:3232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22747.exe
      4⤵
      PID:7376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29409.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3368.exe
      4⤵
      PID:4232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45274.exe
      4⤵
      PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17190.exe
      4⤵
      PID:16824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16165.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16165.exe
    3⤵
    PID:6348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19333.exe
      4⤵
      PID:14756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44854.exe
      4⤵
      PID:16416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4972.exe
      4⤵
      PID:8416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41093.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41093.exe
    3⤵
    PID:10316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50174.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50174.exe
    3⤵
    PID:11544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1171.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1171.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:15200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39657.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39657.exe
    3⤵
    PID:16964
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24036.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24036.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61223.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61223.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55167.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42565.exe
        5⤵
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25923.exe
        6⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37599.exe
        7⤵
        
        PID:11604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44070.exe
        7⤵
        
        PID:13968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48117.exe
        7⤵
        
        PID:16140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44714.exe
        7⤵
        
        PID:8420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20525.exe
        6⤵
        
        PID:8232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50702.exe
        6⤵
        
        PID:12084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56505.exe
        6⤵
        
        PID:13776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36155.exe
        6⤵
        
        PID:6888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34031.exe
        6⤵
        
        PID:17960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47668.exe
        6⤵
        
        PID:10552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65024.exe
        5⤵
        
        PID:5140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28513.exe
        6⤵
        
        PID:8184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60965.exe
        5⤵
        
        PID:8020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25108.exe
        5⤵
        
        PID:10988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34034.exe
        5⤵
        
        PID:12888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62886.exe
        5⤵
        
        PID:14396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39765.exe
        5⤵
        
        PID:17060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47204.exe
      4⤵
      PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22223.exe
        5⤵
        
        PID:452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40945.exe
        5⤵
        
        PID:8304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9669.exe
        5⤵
        
        PID:11972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56505.exe
        5⤵
        
        PID:13804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32071.exe
        5⤵
        
        PID:15968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13610.exe
        5⤵
        
        PID:17884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33450.exe
      4⤵
      PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
        5⤵
        
        PID:11536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44070.exe
        5⤵
        
        PID:13948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48117.exe
        5⤵
        
        PID:15956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52690.exe
        5⤵
        
        PID:16696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34542.exe
      4⤵
      PID:8056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10604.exe
      4⤵
      PID:10376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63384.exe
      4⤵
      PID:12612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24887.exe
      4⤵
      PID:5368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61727.exe
      4⤵
      PID:17224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11373.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11373.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54023.exe
      4⤵
      PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56649.exe
        5⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35181.exe
        6⤵
        
        PID:3952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56592.exe
        6⤵
        
        PID:6320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48579.exe
        6⤵
        
        PID:7896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20525.exe
        5⤵
        
        PID:8224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50702.exe
        5⤵
        
        PID:11996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56505.exe
        5⤵
        
        PID:13992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32071.exe
        5⤵
        
        PID:15952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34031.exe
        5⤵
        
        PID:17980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37362.exe
        5⤵
        
        PID:10604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28999.exe
      4⤵
      PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20957.exe
        5⤵
        
        PID:13808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53432.exe
        5⤵
        
        PID:16216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49155.exe
        5⤵
        
        PID:17028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23954.exe
      4⤵
      PID:8288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55808.exe
      4⤵
      PID:11268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62597.exe
      4⤵
      PID:13780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2139.exe
      4⤵
      PID:16344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36579.exe
      4⤵
      PID:8700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37395.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37395.exe
    3⤵
    PID:4452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53525.exe
      4⤵
      PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6872.exe
        5⤵
        
        PID:11436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37271.exe
        5⤵
        
        PID:13768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17390.exe
        5⤵
        
        PID:15972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60474.exe
        5⤵
        
        PID:16552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40945.exe
      4⤵
      PID:8320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9669.exe
      4⤵
      PID:11964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56505.exe
      4⤵
      PID:13832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54630.exe
      4⤵
      PID:15804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35224.exe
      4⤵
      PID:10756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36924.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36924.exe
    3⤵
    PID:5184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62825.exe
      4⤵
      PID:17772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51881.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51881.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30607.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30607.exe
    3⤵
    PID:11280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54959.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54959.exe
    3⤵
    PID:13436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42790.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42790.exe
    3⤵
    PID:15616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48031.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48031.exe
    3⤵
    PID:7524
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37902.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37902.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24825.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24825.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29903.exe
      4⤵
      PID:3812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39711.exe
        5⤵
        
        PID:5516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47744.exe
        5⤵
        
        PID:8548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45667.exe
        5⤵
        
        PID:11848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6301.exe
        5⤵
        
        PID:13864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49401.exe
        5⤵
        
        PID:16148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11345.exe
        5⤵
        
        PID:8188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33851.exe
      4⤵
      PID:6416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44951.exe
      4⤵
      PID:8688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15315.exe
      4⤵
      PID:12072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5804.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54054.exe
      4⤵
      PID:16356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-206.exe
      4⤵
      PID:17544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43862.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43862.exe
    3⤵
    PID:2112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51989.exe
      4⤵
      PID:1548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20935.exe
      4⤵
      PID:13496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44033.exe
      4⤵
      PID:15756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17495.exe
      4⤵
      PID:16476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7706.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7706.exe
    3⤵
    PID:6732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44376.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44376.exe
    3⤵
    PID:10128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19260.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19260.exe
    3⤵
    PID:4088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36461.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36461.exe
    3⤵
    PID:14420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59635.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59635.exe
    3⤵
    PID:7088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4908.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4908.exe
    3⤵
    PID:18276
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10241.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10241.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42539.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42539.exe
    3⤵
    PID:5104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43193.exe
      4⤵
      PID:6700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29627.exe
      4⤵
      PID:10432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63669.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36172.exe
      4⤵
      PID:15240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4424.exe
      4⤵
      PID:17044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17899.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17899.exe
    3⤵
    PID:6636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7976.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7976.exe
    3⤵
    PID:9392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10821.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10821.exe
    3⤵
    PID:11304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28492.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28492.exe
    3⤵
    PID:13788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28755.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28755.exe
    3⤵
    PID:6868
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6510.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6510.exe
  2⤵
  PID:5432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17293.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17293.exe
    3⤵
    PID:7460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29409.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29409.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:10504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3368.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3368.exe
    3⤵
    PID:4840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29130.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29130.exe
    3⤵
    PID:4908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17190.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17190.exe
    3⤵
    PID:16836
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31736.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31736.exe
  2⤵
  PID:6316
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14227.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14227.exe
  2⤵
  PID:10456
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38733.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38733.exe
  2⤵
  PID:4176
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43172.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43172.exe
  2⤵
  PID:5296
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36700.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36700.exe
  2⤵
  PID:16996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3916 -ip 3916
1⤵
PID:5372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2656 -ip 2656
1⤵
PID:6600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 8668 -ip 8668
1⤵
PID:9172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5412 -ip 5412
1⤵
PID:16084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 15276 -ip 15276
1⤵
PID:16796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 15268 -ip 15268
1⤵
PID:7496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5144 -ip 5144
1⤵
PID:9440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-11638.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-11638.exe
Size 184KB
SHA256 f658131a01d4595905a49a77a9da9d1ef80def59d5724e847c8c12b20e3986a1
MD5 b4aa44fb02c2617d621637c44c198edd
SHA1 2ad0ff08864d18447ace1708d1c3a7d1ca5e9d5d
SHA512 2c3904bb31415ba46d06b6ec0523b8ede896ef9960f9ab9e9bbfc3f3f74bd52054c94300455c4153fe25af3035fb42ada435f2c6134c20201f51bd3cbdc1a0d1
SSDEEP 3072:LT5eOAnKsRU9kx6TFXEo1b6GF3vMqgiiuL:LTenqm6TP1eGF3Eqgiiu
TLSH
T179048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-11944.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-11944.exe
Size 184KB
SHA256 be57ffbc1dd75d096e503af4aa9b0271df784363d64f81f13339c8c59341918e
MD5 c5c1be9d3e47459f3a15df916c1e431a
SHA1 1f3266249d1ec3a013102b1690cb2a91e5b06f22
SHA512 58f3a2ce70bb20c18ac77edc4945a998e0fbd914111de9004c138619f229987ca07598b406c32b533cb2b98f9b9c29365e44b3b815b7b5fba3fde8bf15b3f076
SSDEEP 3072:LTmeOAnKsRU9kx6eFXEo1b6GQ3vMqgiiuX:LTBnqm6eP1eGQ3Eqgiiu
TLSH
T1E5048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-12022.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-12022.exe
Size 184KB
SHA256 712cd03e0277ffa0b820f6155a75228d33c1363fd180c7e461b3d47954a1b2f8
MD5 83bca96ab53e357ea403719aa25ecda1
SHA1 57d82752d7acfbccb96c5c89fd165e385a5fd544
SHA512 76b29c4c6fa201fa3b61d7a80bc7ffb65a0af31086b7d1597298164bdcca6999d692da5ff7f2bfa6573bb71909f0e8bc2627a62c2b01bf979f1917440cc56dd3
SSDEEP 3072:eTmeOAnKsRU9kx6eFXEo1b6G93vMqgiiuX:eTBnqm6eP1eG93Eqgiiu
TLSH
T157048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-12577.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-12577.exe
Size 184KB
SHA256 78239280168bd98b060da23cdc1b2acd9c6c1277925f2c25f680256099c06cf9
MD5 f17fdf26db9e40532e2659c6cae6b404
SHA1 e5ac4d9527d8c8beb588296d36117bd1b9cc6577
SHA512 52dcef71892215de3ff0d97477e6e8bb373d7b95ba1dc6b1cbd10a91dab6e39efae0d686957e2a0da951d6137a160f340d147c6a6bad741cd79f74d6bd748838
SSDEEP 3072:LTmeOAnKsRU9kx6eFXEo1b6GQ3vMqgiiuX:LTBnqm6eP1eGQ3Eqgiiu
TLSH
T178048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-14186.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-14186.exe
Size 184KB
SHA256 d5cecd54d2e25af327110bd40cf3914886cdafda22eb2098f2c2c76549ae8806
MD5 f704ea08de9dee54d0745139f4cc62fb
SHA1 f361df828588848d07bcbda8c49d19c364cb2662
SHA512 7789884e5aea789a6bec828e276cd0be910484dc807dd772a7a5b5fa9dca58864921974ea5d5c39501999257f167a93bbbb2de7b77d16ab7e2ced4eb39a29c64
SSDEEP 3072:LTmyBAnKsRUjkx6eFXEo1b6GQ3vMqgiiur:LT+nqo6eP1eGQ3Eqgiiu
TLSH
T10D048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-18170.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-18170.exe
Size 184KB
SHA256 874f418ff94765de1b2dad9c0cc8756ede09e971a8bb025dd32adc173a7a0d2f
MD5 50cbda8a92e74616f865b870ca8adc91
SHA1 2e03ae64eb521c6dbfa0afa766f585aa2547a22f
SHA512 1ccba32990b4517268a3fee923fd01898d8363254683b348310c0d58e594e912eab91f464047a0bffdb4205e9dc43773cf383476c483e65be5a3f5e42a1f92fd
SSDEEP 3072:LTmuOAnKsRU9kx6eFXEo1b6GQ3vMqgiiuX:LTRnqm6eP1eGQ3Eqgiiu
TLSH
T195048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-18799.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-18799.exe
Size 184KB
SHA256 4f20bcdf6214f621dd8bddeb2438a400d90a8550aec6c052114cbf8c67211a19
MD5 1d16df854e5b346e487cfee810f1f87d
SHA1 f8f023e7e23304e4c51932998ec2462b82e22938
SHA512 14658080353339f11b9859c0d1bebf519e9e1b9b516f5e1b7e6a53d1ccda4d6c7156a0accf856650d7f2ce06aba92c56cd709043b310e67b77c0a02f3383bcd7
SSDEEP 3072:LTmyOAnKsRU9kx6eFXEo1b6Gc3vMqgiiuX:LTtnqm6eP1eGc3Eqgiiu
TLSH
T17C048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-2380.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-2380.exe
Size 184KB
SHA256 22e74eb685e6347dfe0dda559b339fb7621c92b74d2a2d9f4cde8ad156bab746
MD5 0a456e8daccd863d84294baf7118b917
SHA1 df21c6991de2a18e53b1144f0028a75df57a9a33
SHA512 80e1b18506dac12cc49f97778b5950c05ec5fee222012d8f484c79298456dfd43d8f94b55e56db3c6c1d568afab2e6f9009d738fd531d0b78d00696e8179ef97
SSDEEP 3072:LTmyOAnKsRUjkx6eFXEo1b6GQ3vMqgiiur:LTtnqo6eP1eGQ3Eqgiiu
TLSH
T17F048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-24036.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-24036.exe
Size 184KB
SHA256 79437e91d7dbacad10982d870235752ff16c4bfee5083a17d79a222e4be26205
MD5 a26bb2d0bc3504baf9febd0565bfe468
SHA1 efce14ef18bc04db23ec21a108c81ad0e8a9f91f
SHA512 796547d964bc9ce7c8697d3b866a5758d729ab3f96b43af493d6a38ce822444280987c23be176dcf58b5efa590ce4645350dcdfbb4a00803b14ec6ab4005918e
SSDEEP 3072:LTmyOAnKsRU9kx6eFXEo1b6GS3vMqgiiuX:LTtnqm6eP1eGS3Eqgiiu
TLSH
T117048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-24939.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-24939.exe
Size 184KB
SHA256 135ec2e206e870f8be7ce7ba89f567807280b6f46d853640dd0c7f369f870560
MD5 7db46f7c9182410054598c6b4d13d9b0
SHA1 c20f1b4e3ec876ad437cccf6588e625bbd0d2152
SHA512 1eb967b2d6638848a40e9807f751744daa1b03a8869df823e367f4345d361f0392df022023194c23b4f42951806190b86e2400ce6a457c91bd1e0aae0dd54237
SSDEEP 3072:LTmeOAnKsRU9kx6TFXEo1b6GQ3vMqgiiuL:LTBnqm6TP1eGQ3Eqgiiu
TLSH
T1BE048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-25903.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-25903.exe
Size 184KB
SHA256 509675e56d44111b74c8a9138d69a7df47c279d8544b84dc652a499c13c58675
MD5 91d893cb62dd6c5243fab1e1b406069b
SHA1 6f7c7aac812d09ca8c1989d6521e8d027be2a9b5
SHA512 3bbaa61015b1c9572f9f0963b682ac92f372a53e704f25ed6a44c521f313624327e21a28747f33990be0eb08740af82efa94261eb49ecbac342c2db7328f4b02
SSDEEP 3072:LTmyOAnKsRUjkx6eFXEo1b6GQ3vMqgiiuX:LTtnqo6eP1eGQ3Eqgiiu
TLSH
T1C1048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-26413.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-26413.exe
Size 184KB
SHA256 eb047f0235a0934c33f4c17fa08bf387eaad06071db9722e73de80fd0ffd63f6
MD5 089acab80a6a52d0270b8327da07bca6
SHA1 8c9ce4421fc3d76fb7d661ae02a89388c700853c
SHA512 0fea0e75cc1372b60670367e216feaddd48a856252d552db4fc574ad0eaf4405b8dfdcc57d68a2fec8831d6a3c89f834f6c666bc2a9533e341020a29a23f6f66
SSDEEP 3072:LTmyBAnKsRUjkx6eFX8o1b6GQ3vMqgiiur:LT+nqo6e31eGQ3Eqgiiu
TLSH
T1F2048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-2790.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-2790.exe
Size 184KB
SHA256 664a636da305ef0eb507416b2a589867bef2ec6fe3c71a598e66cebade959414
MD5 ae0535717ce90848516a709fd649cd71
SHA1 84d41881719f817f939d2083efdd00a7c8ea8df6
SHA512 512c7c93cd727f8e760450ef6930e368d137363f2407d4b2f76a6c3fb7f7a8ee4c24eb2871a306c6403e2882b59deb928bec216bc54dbb3c592a282d08bb0368
SSDEEP 3072:LTmeOAnKsRU9kx6eFXEo1b6GQ3vMqgiiuL:LTBnqm6eP1eGQ3Eqgiiu
TLSH
T133048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-29131.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-29131.exe
Size 184KB
SHA256 5e5355fb1e21409d277884f0830d54826a7c54ac52467bef535abbb117f0380e
MD5 0bbe9a406ec147cdf0c4284843571e71
SHA1 42b67f6fb24169de8ffc13fd5edd0a0a3d3e7a46
SHA512 488c03fe35bda15962131a52cb91ad7ce13d7d0f197e000f683e1ac594d91a05b7cb7994ed1e1e88d9d9a7d7f2b5df70a7a22506fb38739040248b0f6a41bdba
SSDEEP 3072:LTmeOAnKsRU9kx6eFXEo1b6G23vMqgiiuL:LTBnqm6eP1eG23Eqgiiu
TLSH
T104048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-32178.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-32178.exe
Size 184KB
SHA256 899921563aff369e30f4ded353e96aa4270b8e9507f7c2b8028143b77f0879b8
MD5 c28f22ecf3d52b913fcab311213e03a8
SHA1 549bdf9daf62cb37e8fd23d249049d8a064f671e
SHA512 181017091e5256fb5c8bf6495a32542b4fcb6db7607bd35ba4c8e2f5950896018f8dd332652de1b53fba9b3237969844fdea1accf20954a5ee5b31436f43f37c
SSDEEP 3072:LTmeOAnKsRU9kx6eFXEo1b6Gy3vMqgiiuX:LTBnqm6eP1eGy3Eqgiiu
TLSH
T197048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-37902.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-37902.exe
Size 184KB
SHA256 fbbac233caaab7cd52076f4008b9bb8587029ee65ec90f491650c7e0d70abaa3
MD5 296043072884e0842f66e03c9abe8251
SHA1 34ec03609e7659132857425bd29ec90fcb80fca5
SHA512 e0f9deb04886de92946f89209eb99a009c0712ed1962f07b3f23ac76c4b2d3467f0d3401cee3ca4180e9fdb396dbd15c221f6f7e6b5a72d66a5c44deb526fa71
SSDEEP 3072:LTmyOAnKsRU9kx6eFXEo1b6GI3vMqgiiuX:LTtnqm6eP1eGI3Eqgiiu
TLSH
T132048F6289B0BB13E951093517E06BFB801D3C2F4BE50609BCADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-38757.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-38757.exe
Size 184KB
SHA256 e1f21b355c7c40093efdb163cf0cfdb52b62ab007625ad72f959203b9a4b0eca
MD5 8ec3346dc2a800e81b3f0b14d8bf8db0
SHA1 1312cb476efe0e4b63ef89567fe28b03921e9627
SHA512 89e4c76750eb44ea2a1f48ba3ea93dcc529fe529e544158c8f51131143c8ff285346ae8f247bc938dc96fa5f5e669cbc84d280fafcb7a069ef7d9ab8d65b62ba
SSDEEP 3072:LTmeOAnKsRU9kx6eFXEo1bZGQ3vMqgiiuL:LTBnqm6eP1FGQ3Eqgiiu
TLSH
T134048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-40803.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-40803.exe
Size 184KB
SHA256 09d18bd561e5cf2d3a410240136338635df6660b9f570ea02ecf827baa421a93
MD5 9b113791124c83719b5c50f47e845444
SHA1 2322cba0ab51992d6e6a3e922a803f6d5b563016
SHA512 afda65b156fa2dca4fbb9cbbdd235aa5eb648a7ebe67127aabc3330c19df1c82e0adcbd15c955f66d3d49a892bf40a52952c2a5467b121924f160da8a850f14e
SSDEEP 3072:LTmeOAnKsRU9kx6eFXEo1b6GE3vMqgiiuL:LTBnqm6eP1eGE3Eqgiiu
TLSH
T171048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-42919.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42919.exe
Size 184KB
SHA256 b7916d9f804b6cd6877cd8cdcc3657e269c19c65a873c5f7a38b05fe2c3af1bc
MD5 e5ad5417b9978a292a3672b3316cf088
SHA1 c68b9e0c2e4b418dce92ca698077016cf4f7c137
SHA512 61b2dac6ed71eed15438421d043f797c3f56751af1a92191b764dd02f315ad44aa264a2b6813db41a2802595413dc469f8ee40e7d43835142fc3c682e80dc90a
SSDEEP 3072:LxmeOAnKsRU9kx6TFXEo1b6GQ3vMqgiiuL:LxBnqm6TP1eGQ3Eqgiiu
TLSH
T130048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-43325.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-43325.exe
Size 184KB
SHA256 0f1e0d755cc08893764837bc511f39d3639f1a7cd79ce2f1c62822004fa6cc28
MD5 7aa5d1a10f5d51b311d398293307bf72
SHA1 2036c31213e33a2356e7d55c7afd9952b0a2761a
SHA512 57cba75ead0a6d65dd89ce27261f3cdfc044b61fe8866fc31dd646d700fedb4fb4a7c0653b3feddbcdfc513e4fb6a93ee16812cd262c1fdbcff1a18a52bbfdd9
SSDEEP 3072:LT5eOAnKsRU9kx6TFXEo1b6GZ3vMqgiiuL:LTenqm6TP1eGZ3Eqgiiu
TLSH
T12F048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-4418.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-4418.exe
Size 184KB
SHA256 c5439fda08c5a9f16df3e61619d19b8a6a63a1ad20e2650104b831a851aff64c
MD5 7b63c32fa173b541fb2926c9fbbdeccb
SHA1 60c7a72a0728cd381ae99b0c9b42854e815e4fda
SHA512 12b224512eff02ad4007e7641384ee78ea1daf2c75619120911d36249d1f3bd10ac82eb14310a7abb2c096ccc28c2b3fdf127f4032eb95e2eff3bbfaafcb0f48
SSDEEP 3072:LTmyOAnKsRU9kx6eFXEo1b6GS3vMqgiiuX:LTtnqm6eP1eGS3Eqgiiu
TLSH
T18B048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-45468.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-45468.exe
Size 184KB
SHA256 bac91077dc0bd6fc444ac8725acecfd5479a784133e0dc15821a54f99cdc5e83
MD5 6a412a5d5fcccd9f6a49391d95031b8e
SHA1 f2936db80dbe7d13082b904f9e6e9a44ecd239f7
SHA512 d04cca1ae1425f6786577603198d38ffc8f93cbe4abb5a049209594113bfd04dc2f41f981b0bd96db521ca1ee6408ea12b643095390c8abede3a349864ecdad5
SSDEEP 3072:LTSyOAnKsRUjkx6eFXEo1b6GQ3vMqgiiuX:LTZnqo6eP1eGQ3Eqgiiu
TLSH
T15F048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-45779.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-45779.exe
Size 184KB
SHA256 7816eb25ce2cc5bb6f75893a2b19887c88fc4ad434b213dff6c507e3310d71f6
MD5 f90c2dd1df183a17982e9f02e1a7dce0
SHA1 27cfc951594c709f9687ec0004589c7a458578fe
SHA512 fcc6b9cfb4401fcc6b4518d2d1e1952adbe5af55f1fb806143218ced1723dbdc2ceaa205e4ba7fe1598870abc9fbf8a32890fa54e2bc80a295bd3aab6974e5c5
SSDEEP 3072:4+myOAnKsRUjkx6eFXeo1b6GQ3vMqgiiur:4+tnqo6e11eGQ3Eqgiiu
TLSH
T101048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-49526.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-49526.exe
Size 184KB
SHA256 dbae51c973047c153e163da385efb1838689bf85a3ce169d3649dc9a1b686e80
MD5 12a8ff86867d770093b01ad1ed262d31
SHA1 a34c454e82578f344e075a33334fe5f1ee7b1cbe
SHA512 bc234c799b047af722b2c93a4d17b9d6ac613e3485b445f4dc1fca65355b60a608da1ce47a80d496aea4118d5cad7529504b4df0db0ae4b87778f6e626a87fdd
SSDEEP 3072:LTmyOunKsRUjkx6eFXEo1b6GQ3vMqgiiur:LTTnqo6eP1eGQ3Eqgiiu
TLSH
T150048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-5725.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-5725.exe
Size 184KB
SHA256 b2f47f646c500ec7c9eed42888fd4a1a51cdc8e802a35c44daa3d207eae41997
MD5 fe0bf5c30155fcbcebc5d6330998d37d
SHA1 39fd9b708c73f5f888fd40beb0ea1a186088bca3
SHA512 5c3a57d83aa2c7d6459dce98f2cf540d62a1cc35a31011236c23c5960ec0e4c65c95d6efe862a3fbe2b5e40ed707e9669a0efdcb4174ec8cb677e0255879a1d6
SSDEEP 3072:BTmeOAnKsRU9kx6eFXEo1b6GI3vMqgiiuX:BTBnqm6eP1eGI3Eqgiiu
TLSH
T1C4048F6289B0BB13E951093517E06BFB801D3C2F4BE50609BCADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-59085.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-59085.exe
Size 184KB
SHA256 9f03c724da986482909eba020c9915dfd80502189913cb0709ff61ab2ac40974
MD5 8294426b1dbf017365a4a0e3f293475e
SHA1 6d183f3d38e6a635c3044f65c0cc64c18c89f167
SHA512 f9f42ed53ef856a4f76bfb8b4c1df5aac448ace7ac0aaf4824e0f997a566678aac9ef72eb9029d915374bc19dcbcdb837011dee71e462b53b4b4371501658e26
SSDEEP 3072:LTmuOAnKsRU9kx6eFXEo1b6Gy3vMqgiiuX:LTRnqm6eP1eGy3Eqgiiu
TLSH
T1D0048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-59303.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-59303.exe
Size 184KB
SHA256 30aadc2ee90bad0602cfce8ed05c808ff6dd868cab8025901dc06e8b3a06b2ac
MD5 220ea935e0094a7f84170cfd0c20650d
SHA1 19d75e02ab40827060c4cb461e331aeef8ffa658
SHA512 b036a278917c93e300f9c177e4e1b56d76e55edcd00864e69954c24b0a4d281bbe11a2b6b121011ca3902c645535ebe45aba3b31524a90383b6f999c63f66dca
SSDEEP 3072:LTmeOAnKsRU9kx6TFXEo1b6GF3vMqgiiuL:LTBnqm6TP1eGF3Eqgiiu
TLSH
T12E048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-60429.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-60429.exe
Size 184KB
SHA256 e919e976b454723664dc9144ab5b865383875b00bc0ec3528697e8d50eeecdf8
MD5 06f1fbe2d6457aa5e10a4fe965ec2c97
SHA1 263b03f7572d7ef8db6131659385f3c82c3dd2df
SHA512 1f013191aa25d8b34b7c3c5faa237dbcc4b95dd1ac2a7ea42f6afbf958a4c6f76324dccfc92cc6a564ec7c554402f7f486fbf8a10fd7e76ec0a5c96a9b245817
SSDEEP 3072:LxmeOAnKsRU9kx6TFXEo1b6G43vMqgiiuL:LxBnqm6TP1eG43Eqgiiu
TLSH
T16E048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-61223.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-61223.exe
Size 184KB
SHA256 0acc57db4b7e4cbb234e7ecd4652e32adbb9598188aa445f4adf172d44a5c2cd
MD5 5b3a5ac89b3dd8aaeb1421863afffc7a
SHA1 7a3472620b98ce8915acb5da4d7212f5f64cf1d6
SHA512 5a244cd011e6ffd5c50cfbb7a65548f02f4e1f2fc3717d1a100265a3fccd0b86b5e3f59651d47bc8ecf458891474ab6a83b26f2980024310a033412a2479f027
SSDEEP 3072:LTSyOAnKsRUjkx6eFXEo1b6Gr3vMqgiiuX:LTZnqo6eP1eGr3Eqgiiu
TLSH
T182048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-61249.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-61249.exe
Size 184KB
SHA256 b020646818209b05cf0c62443af1492f73ca26c8f005b92d7189587a97ff102d
MD5 004143621f97e495d0850cffb3e11725
SHA1 b5c1fa79eff350cbfd6ded542f3c79eb1c91c1fa
SHA512 a78f2486d0318f02b4a7a8898f14647b598846796aeffc8fac891271e039bacac1f4a832f64ec86e1dff6ee6eefe2d11723d85e9db9bf0679603996989b0502e
SSDEEP 3072:LTmyOAnKsRU9kx6eFXEo1b6GD3vMqgiiuX:LTtnqm6eP1eGD3Eqgiiu
TLSH
T1CC048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-62354.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-62354.exe
Size 184KB
SHA256 9b498d6a994021a9fc7c05b98e71cc7968b5f9b88c928ae69da1f92246628130
MD5 ee2620ee2f6a6dafd9ba16924d219a69
SHA1 95c0c7de56ebb28c5d564f6ea5655938c771921d
SHA512 e8c48eef21e6a64968c7d3616594440c295426ab05e3d17114c7339250585ae62c941b44ff98f1a44395d51172087a5f87d8f899dbdf102f038b0d508678962d
SSDEEP 3072:LTmeOAnKsRU9kx6TFXuo1b6GF3vMqgiiuL:LTBnqm6Tt1eGF3Eqgiiu
TLSH
T1A7048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-64681.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-64681.exe
Size 184KB
SHA256 f1fbd043c6739ad3d7b5742ea5c38a57ee1967c89bd51110b9ecaa97b8a8fa7f
MD5 821660fa82e48c2daf1e29c49acac967
SHA1 a9c1ec1ae8fb43cc61d9335734b9ca9e14b5f09a
SHA512 e655d030c61ef0ae87a66ff7970d12b96c3c6c612a8c429c6a15eb6f0d2b9b481abf5d56cd70d16b1e2c20a51697e1f904152f769ba838a1ffb13e25e6380136
SSDEEP 3:pl:
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-7964.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-7964.exe
Size 184KB
SHA256 4eaf416c9d2212b630378cb96c136c8703c40d128ca834653a340d7e6659ef06
MD5 defbcb518a1fe3fac07dd1ae48146a61
SHA1 6c18a9148699215eaefff3b051d92c7eb173392d
SHA512 179025d9bbc21f370aa61aa0c7e4b43ec59855fab34e4df8204f74743ed898dfb57f03fb4765bbefcccd53ab137f77033eae4861ca0823893b41d0fd1a324d42
SSDEEP 3072:eTmeOAnKsRU9kx6eFXEo1b6G93vMqgiiuX:eTBnqm6eP1eG93Eqgiiu
TLSH
T1D1048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-9157.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-9157.exe
Size 184KB
SHA256 675fd3617226217a35c655238534e90371acb912f60d39f418e74b54c3709275
MD5 d77e35ad9a61f0157bc553987f0ff13b
SHA1 f3b78dbb33717463b1ab364facbbfe7f72dc7563
SHA512 8a4eb0f7fa443d3556b6056bcb2265aff65b4634f08bc35a92aaee02fc2249345d9adb0779c79dc9564b79d2e652d724848b9dfc4849ab13f9773040f72129fa
SSDEEP 3072:LTmeOAnKsRU9kx6eFXEo1b6G93vMqgiiuX:LTBnqm6eP1eG93Eqgiiu
TLSH
T1E4048F6289B0BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-9976.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-9976.exe
Size 184KB
SHA256 dcd6ac3f01d255f730a18229983d6bf6246e4555e513cacded74bcbafdf01f0c
MD5 aa7a5e0ae68a007e2b0868bb9e5aaaf4
SHA1 3b15bc21c773a500522885bafcf7b6a022ff7635
SHA512 252d4cb82d30df2026f578136c44938150b8c6e227f295b04eef15bcbb6a3ef36914c39a4277cd91c7e56f6bd2d52bf26d29d0eda7b4d1f1369cbd8a6e8c64cf
SSDEEP 3072:LTmyOAnKsRUjkx6eFXEo1b6GQ3vMqgiiuk:LTtnqo6eP1eGQ3Eqgiiu
TLSH
T1AC048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads