313d7b2e018a1cebed48e251a05b70b0918a87a3a73a5935b40570d6c1f30b86

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 20:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

313d7b2e018a1cebed48e251a05b70b0918a87a3a73a5935b40570d6c1f30b86.exe
Size

468KB
MD5

d448c9a93b5681c539936f1f1628bc04
SHA1

b3ac2a7ede5467f7bb83ac534d48b459ce502add
SHA256

313d7b2e018a1cebed48e251a05b70b0918a87a3a73a5935b40570d6c1f30b86
SHA512

14c16602d986af42a0c893f409811e0d7b82fbd2afae827dc8cde1c13b1fe9a6bf7ad73aa421bcd636193045c0c1ba1e492dcb2b235149ec975e9a5b895d1268
SSDEEP

3072:4MOKogI/JU57tbYEwzmjbfD/ECLHlIp9QmHeQ2Y6q1jL9rWudplE:4Mbozc7t7wqjbfH0k7q1nxWud

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4252	Unicorn-26632.exe
1848	Unicorn-5225.exe
4164	Unicorn-9864.exe
1640	Unicorn-35734.exe
3540	Unicorn-9646.exe
4568	Unicorn-17260.exe
216	Unicorn-8991.exe
3100	Unicorn-63336.exe
1484	Unicorn-59807.exe
2688	Unicorn-22304.exe
4628	Unicorn-63891.exe
5100	Unicorn-16082.exe
1868	Unicorn-1783.exe
2872	Unicorn-7913.exe
4588	Unicorn-3564.exe
3988	Unicorn-58266.exe
3596	Unicorn-62905.exe
2508	Unicorn-39792.exe
4520	Unicorn-29577.exe
4428	Unicorn-9733.exe
2564	Unicorn-11587.exe
2056	Unicorn-49091.exe
1908	Unicorn-17618.exe
2044	Unicorn-44260.exe
4744	Unicorn-9449.exe
2972	Unicorn-51037.exe
4564	Unicorn-35827.exe
2280	Unicorn-44815.exe
4704	Unicorn-55750.exe
2092	Unicorn-23010.exe
3996	Unicorn-21618.exe
540	Unicorn-13258.exe
2480	Unicorn-24956.exe
2612	Unicorn-56258.exe
4972	Unicorn-52174.exe
2412	Unicorn-15780.exe
1656	Unicorn-21347.exe
1776	Unicorn-27213.exe
1020	Unicorn-27213.exe
744	Unicorn-33508.exe
4872	Unicorn-64789.exe
5012	Unicorn-19118.exe
4200	Unicorn-41676.exe
4468	Unicorn-62864.exe
1504	Unicorn-49850.exe
4840	Unicorn-48474.exe
440	Unicorn-44390.exe
1348	Unicorn-27953.exe
4848	Unicorn-34084.exe
4100	Unicorn-23778.exe
960	Unicorn-30554.exe
3276	Unicorn-16786.exe
5016	Unicorn-22386.exe
244	Unicorn-56542.exe
2676	Unicorn-42806.exe
1636	Unicorn-58972.exe
2560	Unicorn-24716.exe
2776	Unicorn-9771.exe
1292	Unicorn-28145.exe
4344	Unicorn-2179.exe
1888	Unicorn-22600.exe
4524	Unicorn-16469.exe
3752	Unicorn-33460.exe
1608	Unicorn-29376.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
14168	5892	WerFault.exe	206
18156	15152	WerFault.exe	740
17460	5104	WerFault.exe	750
17400	516	WerFault.exe	828

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8763.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34038.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2737.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44275.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42834.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34447.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61307.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64751.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15302.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52418.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36637.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9505.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2738.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51747.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24039.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17608.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63126.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9771.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24934.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48451.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63855.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15731.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-756.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14535.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55612.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59885.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58728.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57392.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52999.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7396.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38995.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63891.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38028.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38094.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44260.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54213.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18201.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18445.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7755.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52811.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35340.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6716.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33096.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44556.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26970.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7913.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62409.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60293.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59565.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7235.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63822.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44275.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 26 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun	OfficeClickToRun.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5508	svchost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	1476	dwm.exe
Token: SeChangeNotifyPrivilege	1476	dwm.exe
Token: 33	1476	dwm.exe
Token: SeIncBasePriorityPrivilege	1476	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
992	313d7b2e018a1cebed48e251a05b70b0918a87a3a73a5935b40570d6c1f30b86.exe
4252	Unicorn-26632.exe
1848	Unicorn-5225.exe
4164	Unicorn-9864.exe
1640	Unicorn-35734.exe
3540	Unicorn-9646.exe
4568	Unicorn-17260.exe
216	Unicorn-8991.exe
3100	Unicorn-63336.exe
1484	Unicorn-59807.exe
2688	Unicorn-22304.exe
1868	Unicorn-1783.exe
2872	Unicorn-7913.exe
5100	Unicorn-16082.exe
4588	Unicorn-3564.exe
3988	Unicorn-58266.exe
2508	Unicorn-39792.exe
3596	Unicorn-62905.exe
4520	Unicorn-29577.exe
4428	Unicorn-9733.exe
2564	Unicorn-11587.exe
2056	Unicorn-49091.exe
2044	Unicorn-44260.exe
2972	Unicorn-51037.exe
4564	Unicorn-35827.exe
2280	Unicorn-44815.exe
4704	Unicorn-55750.exe
1908	Unicorn-17618.exe
4744	Unicorn-9449.exe
2092	Unicorn-23010.exe
3996	Unicorn-21618.exe
540	Unicorn-13258.exe
2480	Unicorn-24956.exe
2612	Unicorn-56258.exe
4972	Unicorn-52174.exe
2412	Unicorn-15780.exe
1776	Unicorn-27213.exe
1656	Unicorn-21347.exe
1020	Unicorn-27213.exe
744	Unicorn-33508.exe
4872	Unicorn-64789.exe
5012	Unicorn-19118.exe
4200	Unicorn-41676.exe
1504	Unicorn-49850.exe
4468	Unicorn-62864.exe
4840	Unicorn-48474.exe
4848	Unicorn-34084.exe
244	Unicorn-56542.exe
440	Unicorn-44390.exe
960	Unicorn-30554.exe
4100	Unicorn-23778.exe
3276	Unicorn-16786.exe
1348	Unicorn-27953.exe
2676	Unicorn-42806.exe
1636	Unicorn-58972.exe
2560	Unicorn-24716.exe
2776	Unicorn-9771.exe
1292	Unicorn-28145.exe
1608	Unicorn-29376.exe
3752	Unicorn-33460.exe
4524	Unicorn-16469.exe
4344	Unicorn-2179.exe
1888	Unicorn-22600.exe
380	Unicorn-40882.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 4252	992	313d7b2e018a1cebed48e251a05b70b0918a87a3a73a5935b40570d6c1f30b86.exe	87
PID 992 wrote to memory of 4252	992	313d7b2e018a1cebed48e251a05b70b0918a87a3a73a5935b40570d6c1f30b86.exe	87
PID 992 wrote to memory of 4252	992	313d7b2e018a1cebed48e251a05b70b0918a87a3a73a5935b40570d6c1f30b86.exe	87
PID 4252 wrote to memory of 1848	4252	Unicorn-26632.exe	90
PID 4252 wrote to memory of 1848	4252	Unicorn-26632.exe	90
PID 4252 wrote to memory of 1848	4252	Unicorn-26632.exe	90
PID 992 wrote to memory of 4164	992	313d7b2e018a1cebed48e251a05b70b0918a87a3a73a5935b40570d6c1f30b86.exe	91
PID 992 wrote to memory of 4164	992	313d7b2e018a1cebed48e251a05b70b0918a87a3a73a5935b40570d6c1f30b86.exe	91
PID 992 wrote to memory of 4164	992	313d7b2e018a1cebed48e251a05b70b0918a87a3a73a5935b40570d6c1f30b86.exe	91
PID 1848 wrote to memory of 1640	1848	Unicorn-5225.exe	95
PID 1848 wrote to memory of 1640	1848	Unicorn-5225.exe	95
PID 1848 wrote to memory of 1640	1848	Unicorn-5225.exe	95
PID 4252 wrote to memory of 3540	4252	Unicorn-26632.exe	96
PID 4252 wrote to memory of 3540	4252	Unicorn-26632.exe	96
PID 4252 wrote to memory of 3540	4252	Unicorn-26632.exe	96
PID 4164 wrote to memory of 4568	4164	Unicorn-9864.exe	97
PID 4164 wrote to memory of 4568	4164	Unicorn-9864.exe	97
PID 4164 wrote to memory of 4568	4164	Unicorn-9864.exe	97
PID 992 wrote to memory of 216	992	313d7b2e018a1cebed48e251a05b70b0918a87a3a73a5935b40570d6c1f30b86.exe	98
PID 992 wrote to memory of 216	992	313d7b2e018a1cebed48e251a05b70b0918a87a3a73a5935b40570d6c1f30b86.exe	98
PID 992 wrote to memory of 216	992	313d7b2e018a1cebed48e251a05b70b0918a87a3a73a5935b40570d6c1f30b86.exe	98
PID 1640 wrote to memory of 3100	1640	Unicorn-35734.exe	101
PID 1640 wrote to memory of 3100	1640	Unicorn-35734.exe	101
PID 1640 wrote to memory of 3100	1640	Unicorn-35734.exe	101
PID 1848 wrote to memory of 1484	1848	Unicorn-5225.exe	102
PID 1848 wrote to memory of 1484	1848	Unicorn-5225.exe	102
PID 1848 wrote to memory of 1484	1848	Unicorn-5225.exe	102
PID 4568 wrote to memory of 2688	4568	Unicorn-17260.exe	103
PID 4568 wrote to memory of 2688	4568	Unicorn-17260.exe	103
PID 4568 wrote to memory of 2688	4568	Unicorn-17260.exe	103
PID 4164 wrote to memory of 4628	4164	Unicorn-9864.exe	104
PID 4164 wrote to memory of 4628	4164	Unicorn-9864.exe	104
PID 4164 wrote to memory of 4628	4164	Unicorn-9864.exe	104
PID 3540 wrote to memory of 5100	3540	Unicorn-9646.exe	105
PID 3540 wrote to memory of 5100	3540	Unicorn-9646.exe	105
PID 3540 wrote to memory of 5100	3540	Unicorn-9646.exe	105
PID 4252 wrote to memory of 1868	4252	Unicorn-26632.exe	106
PID 4252 wrote to memory of 1868	4252	Unicorn-26632.exe	106
PID 4252 wrote to memory of 1868	4252	Unicorn-26632.exe	106
PID 216 wrote to memory of 2872	216	Unicorn-8991.exe	107
PID 216 wrote to memory of 2872	216	Unicorn-8991.exe	107
PID 216 wrote to memory of 2872	216	Unicorn-8991.exe	107
PID 992 wrote to memory of 4588	992	313d7b2e018a1cebed48e251a05b70b0918a87a3a73a5935b40570d6c1f30b86.exe	108
PID 992 wrote to memory of 4588	992	313d7b2e018a1cebed48e251a05b70b0918a87a3a73a5935b40570d6c1f30b86.exe	108
PID 992 wrote to memory of 4588	992	313d7b2e018a1cebed48e251a05b70b0918a87a3a73a5935b40570d6c1f30b86.exe	108
PID 3100 wrote to memory of 3988	3100	Unicorn-63336.exe	109
PID 3100 wrote to memory of 3988	3100	Unicorn-63336.exe	109
PID 3100 wrote to memory of 3988	3100	Unicorn-63336.exe	109
PID 1640 wrote to memory of 3596	1640	Unicorn-35734.exe	110
PID 1640 wrote to memory of 3596	1640	Unicorn-35734.exe	110
PID 1640 wrote to memory of 3596	1640	Unicorn-35734.exe	110
PID 1484 wrote to memory of 2508	1484	Unicorn-59807.exe	111
PID 1484 wrote to memory of 2508	1484	Unicorn-59807.exe	111
PID 1484 wrote to memory of 2508	1484	Unicorn-59807.exe	111
PID 4164 wrote to memory of 4520	4164	Unicorn-9864.exe	112
PID 4164 wrote to memory of 4520	4164	Unicorn-9864.exe	112
PID 4164 wrote to memory of 4520	4164	Unicorn-9864.exe	112
PID 1848 wrote to memory of 4428	1848	Unicorn-5225.exe	113
PID 1848 wrote to memory of 4428	1848	Unicorn-5225.exe	113
PID 1848 wrote to memory of 4428	1848	Unicorn-5225.exe	113
PID 2688 wrote to memory of 2564	2688	Unicorn-22304.exe	114
PID 2688 wrote to memory of 2564	2688	Unicorn-22304.exe	114
PID 2688 wrote to memory of 2564	2688	Unicorn-22304.exe	114
PID 4568 wrote to memory of 2056	4568	Unicorn-17260.exe	115

C:\Users\Admin\AppData\Local\Temp\313d7b2e018a1cebed48e251a05b70b0918a87a3a73a5935b40570d6c1f30b86.exe
"C:\Users\Admin\AppData\Local\Temp\313d7b2e018a1cebed48e251a05b70b0918a87a3a73a5935b40570d6c1f30b86.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:992
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26632.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26632.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5225.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5225.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35734.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63336.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58266.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23010.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58972.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21422.exe
        9⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14535.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6624.exe
        11⤵
        
        PID:9272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33899.exe
        11⤵
        
        PID:15308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44275.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26688.exe
        10⤵
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59565.exe
        10⤵
        
        PID:13032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6385.exe
        10⤵
        
        PID:14484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42884.exe
        9⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18776.exe
        9⤵
        
        PID:9256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40288.exe
        9⤵
        
        PID:12844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51197.exe
        9⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59885.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7226.exe
        9⤵
        
        PID:10144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27547.exe
        9⤵
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11585.exe
        9⤵
        
        PID:17772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37128.exe
        9⤵
        
        PID:18216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27739.exe
        9⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15561.exe
        8⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60412.exe
        8⤵
        
        PID:11332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8270.exe
        8⤵
        
        PID:14976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24716.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58754.exe
        8⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21142.exe
        9⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19531.exe
        10⤵
        
        PID:14732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52042.exe
        10⤵
        
        PID:18028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61307.exe
        9⤵
        
        PID:9340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25177.exe
        10⤵
        
        PID:15228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38751.exe
        10⤵
        
        PID:17720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52940.exe
        10⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55673.exe
        9⤵
        
        PID:12432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        9⤵
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44275.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57083.exe
        8⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64133.exe
        9⤵
        
        PID:13648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35793.exe
        9⤵
        
        PID:16676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3810.exe
        8⤵
        
        PID:9304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23952.exe
        8⤵
        
        PID:12452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20470.exe
        8⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2437.exe
        7⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1170.exe
        8⤵
        
        PID:11232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46344.exe
        8⤵
        
        PID:15084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16794.exe
        8⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9613.exe
        8⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9464.exe
        8⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54099.exe
        7⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33464.exe
        7⤵
        
        PID:11036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43073.exe
        7⤵
        
        PID:15532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13580.exe
        7⤵
        
        PID:1732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21618.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9771.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36388.exe
        8⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18620.exe
        9⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21809.exe
        10⤵
        
        PID:9020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46406.exe
        10⤵
        
        PID:13616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42312.exe
        10⤵
        
        PID:17748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59579.exe
        10⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12490.exe
        9⤵
        
        PID:9628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55673.exe
        9⤵
        
        PID:13200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        9⤵
        
        PID:364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59221.exe
        8⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16303.exe
        9⤵
        
        PID:11340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61860.exe
        9⤵
        
        PID:16412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2124.exe
        9⤵
        
        PID:12020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61371.exe
        8⤵
        
        PID:9916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45934.exe
        8⤵
        
        PID:14120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36614.exe
        8⤵
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3589.exe
        7⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15971.exe
        8⤵
        
        PID:10220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61165.exe
        9⤵
        
        PID:14448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20381.exe
        9⤵
        
        PID:18192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15808.exe
        9⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47486.exe
        9⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24039.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7501.exe
        8⤵
        
        PID:17724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28768.exe
        8⤵
        
        PID:15468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52820.exe
        8⤵
        
        PID:14596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4872.exe
        7⤵
        
        PID:9140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56765.exe
        7⤵
        
        PID:13156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60344.exe
        7⤵
        
        PID:15624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28145.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5469.exe
        7⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49730.exe
        8⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46505.exe
        9⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62742.exe
        9⤵
        
        PID:13576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42312.exe
        9⤵
        
        PID:17756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28768.exe
        9⤵
        
        PID:18416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18201.exe
        9⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24358.exe
        8⤵
        
        PID:9436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55673.exe
        8⤵
        
        PID:12976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        8⤵
        
        PID:15424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30460.exe
        8⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38800.exe
        7⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7366.exe
        8⤵
        
        PID:12364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27817.exe
        8⤵
        
        PID:16804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30068.exe
        7⤵
        
        PID:8344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21508.exe
        7⤵
        
        PID:14400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17046.exe
        7⤵
        
        PID:1912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17840.exe
        6⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
        7⤵
        
        PID:7900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6114.exe
        7⤵
        
        PID:11932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-983.exe
        7⤵
        
        PID:15372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58017.exe
        7⤵
        
        PID:9000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53602.exe
        6⤵
        
        PID:8036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16929.exe
        6⤵
        
        PID:11156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60139.exe
        6⤵
        
        PID:14816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17882.exe
        6⤵
        
        PID:17764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38587.exe
        6⤵
        
        PID:17744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62905.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24956.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22600.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15776.exe
        8⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1681.exe
        9⤵
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44367.exe
        10⤵
        
        PID:8840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23847.exe
        10⤵
        
        PID:13668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4604.exe
        10⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18129.exe
        10⤵
        
        PID:18244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55612.exe
        9⤵
        
        PID:8756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34422.exe
        9⤵
        
        PID:11916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29136.exe
        9⤵
        
        PID:17216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39760.exe
        8⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6716.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
        8⤵
        
        PID:14768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42199.exe
        8⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61818.exe
        8⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4348.exe
        8⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54239.exe
        7⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
        8⤵
        
        PID:7872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6114.exe
        8⤵
        
        PID:11988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63475.exe
        8⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14218.exe
        7⤵
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18856.exe
        7⤵
        
        PID:12372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60344.exe
        7⤵
        
        PID:15664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29376.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17674.exe
        7⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38028.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39633.exe
        8⤵
        
        PID:11820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15730.exe
        8⤵
        
        PID:15256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31020.exe
        8⤵
        
        PID:18064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24305.exe
        7⤵
        
        PID:8736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13323.exe
        7⤵
        
        PID:11072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20470.exe
        7⤵
        
        PID:3476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7891.exe
        6⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25750.exe
        7⤵
        
        PID:8320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19152.exe
        7⤵
        
        PID:15356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33554.exe
        7⤵
        
        PID:11732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54099.exe
        6⤵
        
        PID:8160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2738.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43073.exe
        6⤵
        
        PID:15460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13580.exe
        6⤵
        
        PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21347.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39128.exe
        6⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44748.exe
        7⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48783.exe
        8⤵
        
        PID:12644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61860.exe
        8⤵
        
        PID:16496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12840.exe
        8⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34498.exe
        7⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36265.exe
        7⤵
        
        PID:11240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2737.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35075.exe
        7⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13974.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6725.exe
        7⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18445.exe
        7⤵
        
        PID:11128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62409.exe
        7⤵
        
        PID:15404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36718.exe
        7⤵
        
        PID:800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31103.exe
        6⤵
        
        PID:8868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49733.exe
        7⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33744.exe
        6⤵
        
        PID:11608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14362.exe
        6⤵
        
        PID:13468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50806.exe
        6⤵
        
        PID:4248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43435.exe
        6⤵
        
        PID:6636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54213.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44722.exe
        6⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1772.exe
        7⤵
        
        PID:10364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12519.exe
        7⤵
        
        PID:12884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23270.exe
        7⤵
        
        PID:17212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34856.exe
        6⤵
        
        PID:8824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59565.exe
        6⤵
        
        PID:13040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20007.exe
        6⤵
        
        PID:16588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7492.exe
        6⤵
        
        PID:11092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24655.exe
        5⤵
        
        PID:6876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15302.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34789.exe
        5⤵
        
        PID:10500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31042.exe
        5⤵
        
        PID:13088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6387.exe
        5⤵
        
        PID:14948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59807.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39792.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33460.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44556.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3243.exe
        8⤵
        
        PID:7336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11362.exe
        9⤵
        
        PID:13288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15119.exe
        9⤵
        
        PID:17604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50811.exe
        9⤵
        
        PID:18056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2369.exe
        9⤵
        
        PID:16132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55612.exe
        8⤵
        
        PID:8924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49608.exe
        8⤵
        
        PID:14988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-974.exe
        8⤵
        
        PID:17476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44805.exe
        8⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58235.exe
        7⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29658.exe
        7⤵
        
        PID:9636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55638.exe
        7⤵
        
        PID:15176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13994.exe
        7⤵
        
        PID:17716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49950.exe
        7⤵
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-456.exe
        7⤵
        
        PID:18316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24995.exe
        6⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6114.exe
        7⤵
        
        PID:11964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-983.exe
        7⤵
        
        PID:15948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63195.exe
        7⤵
        
        PID:17728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18045.exe
        7⤵
        
        PID:5028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39709.exe
        6⤵
        
        PID:7572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54461.exe
        6⤵
        
        PID:11528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57272.exe
        6⤵
        
        PID:15324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57695.exe
        6⤵
        
        PID:17812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15780.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-425.exe
        6⤵
        
        PID:3876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57192.exe
        7⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1105.exe
        8⤵
        
        PID:7536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7392.exe
        9⤵
        
        PID:11572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62872.exe
        9⤵
        
        PID:15332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40191.exe
        9⤵
        
        PID:18324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55612.exe
        8⤵
        
        PID:9476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33272.exe
        8⤵
        
        PID:15008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39351.exe
        8⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23424.exe
        7⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31783.exe
        8⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14045.exe
        8⤵
        
        PID:17544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48544.exe
        7⤵
        
        PID:11680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8270.exe
        7⤵
        
        PID:15244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9652.exe
        7⤵
        
        PID:7144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41794.exe
        6⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62724.exe
        7⤵
        
        PID:7824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6114.exe
        7⤵
        
        PID:11956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-652.exe
        7⤵
        
        PID:15000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11823.exe
        7⤵
        
        PID:17584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        6⤵
        
        PID:2192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56765.exe
        6⤵
        
        PID:13100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60344.exe
        6⤵
        
        PID:16576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20274.exe
        6⤵
        
        PID:12012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13153.exe
        5⤵
        
        PID:1632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55438.exe
        6⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53378.exe
        7⤵
        
        PID:7428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57122.exe
        7⤵
        
        PID:11848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10058.exe
        7⤵
        
        PID:16460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25649.exe
        6⤵
        
        PID:9116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65430.exe
        6⤵
        
        PID:12932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7258.exe
        6⤵
        
        PID:16392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35881.exe
        6⤵
        
        PID:11084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
        5⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42086.exe
        6⤵
        
        PID:7604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23271.exe
        6⤵
        
        PID:13000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14142.exe
        6⤵
        
        PID:16552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26933.exe
        5⤵
        
        PID:9048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17671.exe
        5⤵
        
        PID:12980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11872.exe
        5⤵
        
        PID:15840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9733.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52174.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57218.exe
        6⤵
        
        PID:1008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15776.exe
        7⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8313.exe
        8⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23039.exe
        9⤵
        
        PID:14352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18138.exe
        9⤵
        
        PID:18008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37564.exe
        9⤵
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10160.exe
        8⤵
        
        PID:9264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55673.exe
        8⤵
        
        PID:12952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        8⤵
        
        PID:15804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19744.exe
        8⤵
        
        PID:11640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52999.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5446.exe
        8⤵
        
        PID:11432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62872.exe
        8⤵
        
        PID:16000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12483.exe
        8⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        7⤵
        
        PID:10544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22276.exe
        7⤵
        
        PID:14220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7573.exe
        7⤵
        
        PID:17884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15868.exe
        7⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34156.exe
        7⤵
        
        PID:17444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25074.exe
        6⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56720.exe
        7⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60293.exe
        8⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50925.exe
        8⤵
        
        PID:15700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44232.exe
        8⤵
        
        PID:14508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38821.exe
        8⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16333.exe
        7⤵
        
        PID:9328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37583.exe
        7⤵
        
        PID:13680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23949.exe
        6⤵
        
        PID:8280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60491.exe
        6⤵
        
        PID:11632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57272.exe
        6⤵
        
        PID:15288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57695.exe
        6⤵
        
        PID:17920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33268.exe
        5⤵
        
        PID:1920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32112.exe
        6⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31016.exe
        7⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6524.exe
        7⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41658.exe
        7⤵
        
        PID:14292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32338.exe
        7⤵
        
        PID:16892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42884.exe
        6⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44051.exe
        7⤵
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30068.exe
        6⤵
        
        PID:8356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18751.exe
        6⤵
        
        PID:13744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1804.exe
        6⤵
        
        PID:15448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28503.exe
        5⤵
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
        6⤵
        
        PID:7844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6114.exe
        6⤵
        
        PID:11972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21569.exe
        6⤵
        
        PID:4868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3818.exe
        6⤵
        
        PID:8328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50015.exe
        5⤵
        
        PID:3652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51747.exe
        5⤵
        
        PID:11304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43073.exe
        5⤵
        
        PID:15560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63725.exe
        5⤵
        
        PID:17972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13580.exe
        5⤵
        
        PID:16240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27213.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8401.exe
        5⤵
        
        PID:2844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
        6⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49294.exe
        7⤵
        
        PID:8240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38647.exe
        7⤵
        
        PID:10480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10058.exe
        7⤵
        
        PID:516
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 516 -s 472
        8⤵
        Program crash
        
        PID:17400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18162.exe
        6⤵
        
        PID:8000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54547.exe
        6⤵
        
        PID:11352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16935.exe
        6⤵
        
        PID:15144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57165.exe
        6⤵
        
        PID:17980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42165.exe
        6⤵
        
        PID:18044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
        6⤵
        
        PID:11736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34010.exe
        5⤵
        
        PID:6424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49294.exe
        6⤵
        
        PID:6616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7921.exe
        6⤵
        
        PID:12388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53997.exe
        6⤵
        
        PID:16584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13999.exe
        5⤵
        
        PID:8768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13323.exe
        5⤵
        
        PID:11268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44591.exe
        5⤵
        
        PID:16796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48325.exe
        5⤵
        
        PID:9084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45548.exe
      4⤵
      PID:1892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23342.exe
        5⤵
        
        PID:6924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60293.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33899.exe
        6⤵
        
        PID:15168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26908.exe
        6⤵
        
        PID:17864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46989.exe
        6⤵
        
        PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61115.exe
        5⤵
        
        PID:9108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55673.exe
        5⤵
        
        PID:13212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        5⤵
        
        PID:16820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11576.exe
        5⤵
        
        PID:12492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13382.exe
      4⤵
      PID:6552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23345.exe
        5⤵
        
        PID:10584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33899.exe
        5⤵
        
        PID:15208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26908.exe
        5⤵
        
        PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3818.exe
        5⤵
        
        PID:8292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31872.exe
      4⤵
      PID:13320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38291.exe
      4⤵
      PID:4476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9646.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9646.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16082.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44260.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33508.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56040.exe
        7⤵
        
        PID:332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49792.exe
        8⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52418.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6114.exe
        9⤵
        
        PID:11996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27792.exe
        9⤵
        
        PID:15592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36106.exe
        9⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-264.exe
        8⤵
        
        PID:8776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19518.exe
        8⤵
        
        PID:12424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15923.exe
        8⤵
        
        PID:16516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24856.exe
        7⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13796.exe
        8⤵
        
        PID:18100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62041.exe
        8⤵
        
        PID:17820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40424.exe
        7⤵
        
        PID:8484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65430.exe
        7⤵
        
        PID:13164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7258.exe
        7⤵
        
        PID:14640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52820.exe
        7⤵
        
        PID:8224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47057.exe
        6⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56720.exe
        7⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45594.exe
        8⤵
        
        PID:8612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57392.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49791.exe
        8⤵
        
        PID:18240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49757.exe
        8⤵
        
        PID:17472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36637.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26880.exe
        7⤵
        
        PID:9592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55673.exe
        7⤵
        
        PID:12912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63855.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51742.exe
        6⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48119.exe
        7⤵
        
        PID:14360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18138.exe
        7⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18129.exe
        7⤵
        
        PID:18424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42924.exe
        6⤵
        
        PID:10508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3018.exe
        7⤵
        
        PID:8980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52043.exe
        6⤵
        
        PID:12996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16187.exe
        6⤵
        
        PID:15708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64789.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20654.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14021.exe
        7⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31998.exe
        8⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18445.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62409.exe
        8⤵
        
        PID:15552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38582.exe
        7⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19240.exe
        7⤵
        
        PID:12768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56260.exe
        7⤵
        
        PID:16508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23896.exe
        6⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-477.exe
        7⤵
        
        PID:8788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40069.exe
        7⤵
        
        PID:14128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28944.exe
        7⤵
        
        PID:15692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58255.exe
        7⤵
        
        PID:17416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24305.exe
        6⤵
        
        PID:8744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33744.exe
        6⤵
        
        PID:11492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
        6⤵
        
        PID:13508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26009.exe
        6⤵
        
        PID:17688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45634.exe
        5⤵
        
        PID:1352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63004.exe
        6⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52418.exe
        7⤵
        
        PID:7892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18445.exe
        7⤵
        
        PID:11180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62409.exe
        7⤵
        
        PID:5104
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 436
        8⤵
        Program crash
        
        PID:17460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37596.exe
        6⤵
        
        PID:7400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1236.exe
        6⤵
        
        PID:12120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50734.exe
        6⤵
        
        PID:16624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26028.exe
        6⤵
        
        PID:18116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49273.exe
        5⤵
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45327.exe
        6⤵
        
        PID:10436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
        6⤵
        
        PID:13124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62165.exe
        6⤵
        
        PID:4288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56290.exe
        5⤵
        
        PID:9544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7749.exe
        5⤵
        
        PID:12760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43372.exe
        5⤵
        
        PID:17704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44815.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
        5⤵
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55054.exe
        6⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21142.exe
        7⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18301.exe
        8⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32363.exe
        8⤵
        
        PID:14212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45445.exe
        8⤵
        
        PID:16540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61307.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56287.exe
        8⤵
        
        PID:15600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55673.exe
        7⤵
        
        PID:13120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        7⤵
        
        PID:2868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11966.exe
        6⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52535.exe
        7⤵
        
        PID:9664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59198.exe
        7⤵
        
        PID:13900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42312.exe
        7⤵
        
        PID:17740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58017.exe
        7⤵
        
        PID:8896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3810.exe
        6⤵
        
        PID:9012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21237.exe
        6⤵
        
        PID:13292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32338.exe
        6⤵
        
        PID:16904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46789.exe
        6⤵
        
        PID:2616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55530.exe
        5⤵
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31806.exe
        6⤵
        
        PID:7412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22529.exe
        6⤵
        
        PID:11064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62409.exe
        6⤵
        
        PID:4236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34447.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28586.exe
        5⤵
        
        PID:9232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41485.exe
        5⤵
        
        PID:1904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-456.exe
        5⤵
        
        PID:11768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63559.exe
      4⤵
      PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14213.exe
        5⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53814.exe
        6⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11476.exe
        7⤵
        
        PID:11484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62872.exe
        7⤵
        
        PID:14172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63822.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24934.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27084.exe
        6⤵
        
        PID:12356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        6⤵
        
        PID:15204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64861.exe
        6⤵
        
        PID:10944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8763.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18995.exe
        5⤵
        
        PID:8140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57279.exe
        5⤵
        
        PID:15096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62996.exe
        5⤵
        
        PID:17576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23274.exe
        5⤵
        
        PID:18400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe
      4⤵
      PID:6156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1271.exe
        5⤵
        
        PID:7608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6114.exe
        5⤵
        
        PID:11980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63475.exe
        5⤵
        
        PID:14496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23655.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9246.exe
      4⤵
      PID:8584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41945.exe
      4⤵
      PID:11272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25152.exe
      4⤵
      PID:16424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1783.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1783.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9449.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62864.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21230.exe
        6⤵
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28796.exe
        7⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe
        8⤵
        
        PID:9376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
        8⤵
        
        PID:12764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53997.exe
        8⤵
        
        PID:16432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10762.exe
        7⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7458.exe
        7⤵
        
        PID:11316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15923.exe
        7⤵
        
        PID:15580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43522.exe
        6⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36082.exe
        7⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8591.exe
        8⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18445.exe
        7⤵
        
        PID:11172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62409.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24231.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31103.exe
        6⤵
        
        PID:8860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41513.exe
        7⤵
        
        PID:15136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13173.exe
        7⤵
        
        PID:17872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52940.exe
        7⤵
        
        PID:6748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33744.exe
        6⤵
        
        PID:12448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8140.exe
        6⤵
        
        PID:13568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26009.exe
        6⤵
        
        PID:17680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16522.exe
        5⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58728.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43290.exe
        7⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39583.exe
        8⤵
        
        PID:18284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58518.exe
        7⤵
        
        PID:10896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27022.exe
        7⤵
        
        PID:14684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48726.exe
        7⤵
        
        PID:17520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12816.exe
        7⤵
        
        PID:17468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34537.exe
        7⤵
        
        PID:6540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64047.exe
        6⤵
        
        PID:8512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3018.exe
        7⤵
        
        PID:8976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48299.exe
        6⤵
        
        PID:11728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10277.exe
        6⤵
        
        PID:16736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9464.exe
        6⤵
        
        PID:17464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28633.exe
        5⤵
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29925.exe
        6⤵
        
        PID:12116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27817.exe
        6⤵
        
        PID:16900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
        5⤵
        
        PID:9312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52873.exe
        5⤵
        
        PID:13328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50806.exe
        5⤵
        
        PID:2772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30554.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25698.exe
        5⤵
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60866.exe
        6⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52418.exe
        7⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6114.exe
        7⤵
        
        PID:12004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44538.exe
        7⤵
        
        PID:15732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35566.exe
        7⤵
        
        PID:14596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22285.exe
        7⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33704.exe
        6⤵
        
        PID:8936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11741.exe
        7⤵
        
        PID:8996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53753.exe
        6⤵
        
        PID:12076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15949.exe
        6⤵
        
        PID:15416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58017.exe
        6⤵
        
        PID:8912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29864.exe
        5⤵
        
        PID:6464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38094.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32950.exe
        5⤵
        
        PID:13596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64627.exe
        5⤵
        
        PID:3796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64876.exe
      4⤵
      PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7327.exe
        5⤵
        
        PID:7476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37429.exe
        6⤵
        
        PID:15344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48856.exe
        6⤵
        
        PID:17228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55612.exe
        5⤵
        
        PID:9892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18086.exe
        5⤵
        
        PID:13724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23106.exe
        5⤵
        
        PID:17204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12298.exe
      4⤵
      PID:8172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38995.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3916.exe
      4⤵
      PID:10916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34329.exe
      4⤵
      PID:14460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31847.exe
      4⤵
      PID:18212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35827.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35827.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19118.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27836.exe
        5⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27426.exe
        6⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18952.exe
        7⤵
        
        PID:8532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45830.exe
        7⤵
        
        PID:13108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51667.exe
        7⤵
        
        PID:4860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52947.exe
        6⤵
        
        PID:9156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59565.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20007.exe
        6⤵
        
        PID:16952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34544.exe
        6⤵
        
        PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18982.exe
        5⤵
        
        PID:2460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27201.exe
        6⤵
        
        PID:18096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23645.exe
        6⤵
        
        PID:14596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61538.exe
        5⤵
        
        PID:12524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1804.exe
        5⤵
        
        PID:15392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62520.exe
      4⤵
      PID:6568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19554.exe
        5⤵
        
        PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40811.exe
        5⤵
        
        PID:11344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-620.exe
        6⤵
        
        PID:16456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11070.exe
        5⤵
        
        PID:15016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47548.exe
        5⤵
        
        PID:17656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48011.exe
        5⤵
        
        PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63126.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3912.exe
      4⤵
      PID:7836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55805.exe
      4⤵
      PID:12400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32139.exe
      4⤵
      PID:16808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49850.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49850.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23368.exe
      4⤵
      PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44748.exe
        5⤵
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10399.exe
        6⤵
        
        PID:7684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57122.exe
        6⤵
        
        PID:12056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10058.exe
        6⤵
        
        PID:2464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51073.exe
        6⤵
        
        PID:5908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34498.exe
        5⤵
        
        PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12555.exe
        5⤵
        
        PID:12108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7092.exe
        5⤵
        
        PID:15668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20593.exe
        5⤵
        
        PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-456.exe
        5⤵
        
        PID:11772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41794.exe
      4⤵
      PID:6168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47540.exe
        5⤵
        
        PID:8068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53998.exe
        5⤵
        
        PID:12956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10058.exe
        5⤵
        
        PID:16400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18705.exe
        5⤵
        
        PID:17808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28581.exe
      4⤵
      PID:8600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37252.exe
      4⤵
      PID:12060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53771.exe
      4⤵
      PID:14488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56714.exe
      4⤵
      PID:8548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29012.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29012.exe
    3⤵
    PID:1688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26378.exe
      4⤵
      PID:7500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30439.exe
        5⤵
        
        PID:14412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20381.exe
        5⤵
        
        PID:18176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38367.exe
        5⤵
        
        PID:5028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52940.exe
        5⤵
        
        PID:12252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55612.exe
      4⤵
      PID:8636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34422.exe
      4⤵
      PID:1800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29136.exe
      4⤵
      PID:15072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2217.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2217.exe
    3⤵
    PID:8132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5666.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5666.exe
    3⤵
    PID:10688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3917.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3917.exe
    3⤵
    PID:14656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5673.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5673.exe
    3⤵
    PID:18416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28482.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28482.exe
    3⤵
    PID:3312
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9864.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9864.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17260.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17260.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22304.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11587.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34084.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36262.exe
        7⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35314.exe
        8⤵
        
        PID:8012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19239.exe
        8⤵
        
        PID:10464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54843.exe
        8⤵
        
        PID:13192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37304.exe
        8⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36201.exe
        7⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60491.exe
        7⤵
        
        PID:11624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57272.exe
        7⤵
        
        PID:15284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11883.exe
        7⤵
        
        PID:12260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41218.exe
        6⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23856.exe
        7⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48451.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3235.exe
        8⤵
        
        PID:13760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1890.exe
        8⤵
        
        PID:15224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65463.exe
        8⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47636.exe
        7⤵
        
        PID:9880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17702.exe
        7⤵
        
        PID:13940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        7⤵
        
        PID:15576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49604.exe
        6⤵
        
        PID:8116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40786.exe
        6⤵
        
        PID:10588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39181.exe
        6⤵
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4317.exe
        6⤵
        
        PID:15508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56424.exe
        6⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56720.exe
        7⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60293.exe
        8⤵
        
        PID:10136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36037.exe
        8⤵
        
        PID:15192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26142.exe
        8⤵
        
        PID:17864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59241.exe
        8⤵
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20417.exe
        7⤵
        
        PID:9292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37583.exe
        7⤵
        
        PID:13688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        7⤵
        
        PID:15104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59625.exe
        7⤵
        
        PID:8552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe
        6⤵
        
        PID:8052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37059.exe
        6⤵
        
        PID:10484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60708.exe
        6⤵
        
        PID:11408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32722.exe
        6⤵
        
        PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38810.exe
        5⤵
        
        PID:6012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21142.exe
        6⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27839.exe
        7⤵
        
        PID:10024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39799.exe
        7⤵
        
        PID:12848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39643.exe
        7⤵
        
        PID:17896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65391.exe
        6⤵
        
        PID:9296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55673.exe
        6⤵
        
        PID:11876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        6⤵
        
        PID:15620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27675.exe
        5⤵
        
        PID:6204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6868.exe
        6⤵
        
        PID:15124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27268.exe
        5⤵
        
        PID:9276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59088.exe
        5⤵
        
        PID:13728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65157.exe
        5⤵
        
        PID:4812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49091.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41676.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21374.exe
        6⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20247.exe
        7⤵
        
        PID:10160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
        7⤵
        
        PID:14252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29108.exe
        7⤵
        
        PID:16644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9147.exe
        6⤵
        
        PID:8232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1673.exe
        6⤵
        
        PID:11540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17590.exe
        6⤵
        
        PID:15488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7898.exe
        6⤵
        
        PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51141.exe
        5⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1105.exe
        6⤵
        
        PID:7364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64751.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58326.exe
        6⤵
        
        PID:924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35793.exe
        6⤵
        
        PID:14300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2737.exe
        6⤵
        
        PID:15432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63802.exe
        5⤵
        
        PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12581.exe
        5⤵
        
        PID:10904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50865.exe
        5⤵
        
        PID:14476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55814.exe
        5⤵
        
        PID:18344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36097.exe
        5⤵
        
        PID:17440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38240.exe
        5⤵
        
        PID:5956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27953.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54478.exe
        5⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21910.exe
        6⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26085.exe
        7⤵
        
        PID:8568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13733.exe
        7⤵
        
        PID:13492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12240.exe
        7⤵
        
        PID:17900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16333.exe
        6⤵
        
        PID:9528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34038.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        6⤵
        
        PID:15484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        5⤵
        
        PID:8092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47173.exe
        5⤵
        
        PID:10552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19483.exe
        5⤵
        
        PID:13864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51737.exe
        5⤵
        
        PID:3268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18687.exe
      4⤵
      PID:6600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21474.exe
        5⤵
        
        PID:9132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41937.exe
        5⤵
        
        PID:11864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11585.exe
        5⤵
        
        PID:17780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30242.exe
      4⤵
      PID:8928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25609.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34088.exe
      4⤵
      PID:16440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63891.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63891.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29577.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29577.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56258.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40882.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15776.exe
        6⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46030.exe
        7⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62701.exe
        8⤵
        
        PID:15452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10111.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35253.exe
        7⤵
        
        PID:12532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        7⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59625.exe
        7⤵
        
        PID:7256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34716.exe
        6⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6432.exe
        7⤵
        
        PID:10348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5119.exe
        7⤵
        
        PID:14604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52591.exe
        7⤵
        
        PID:18268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9421.exe
        7⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52417.exe
        7⤵
        
        PID:15664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61371.exe
        6⤵
        
        PID:9836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23568.exe
        6⤵
        
        PID:13928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39669.exe
        6⤵
        
        PID:17664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24882.exe
        5⤵
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43072.exe
        6⤵
        
        PID:1192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46816.exe
        6⤵
        
        PID:12340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14142.exe
        6⤵
        
        PID:15812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59738.exe
        6⤵
        
        PID:18428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48234.exe
        5⤵
        
        PID:6416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42130.exe
        5⤵
        
        PID:11108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59609.exe
        5⤵
        
        PID:14804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37352.exe
      4⤵
      PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6045.exe
        5⤵
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19388.exe
        6⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4580.exe
        7⤵
        
        PID:1056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22171.exe
        6⤵
        
        PID:10128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41283.exe
        6⤵
        
        PID:13416
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5892 -s 740
        6⤵
        Program crash
        
        PID:14168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42884.exe
        5⤵
        
        PID:7176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61371.exe
        5⤵
        
        PID:9932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48727.exe
        5⤵
        
        PID:14628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33255.exe
        5⤵
        
        PID:18320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36097.exe
        5⤵
        
        PID:15220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14908.exe
      4⤵
      PID:6880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10399.exe
        5⤵
        
        PID:7392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12748.exe
        6⤵
        
        PID:8524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16089.exe
        5⤵
        
        PID:12412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14142.exe
        5⤵
        
        PID:15728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45408.exe
      4⤵
      PID:9088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40229.exe
      4⤵
      PID:13076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7788.exe
      4⤵
      PID:16488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27213.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27213.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20414.exe
      4⤵
      PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1105.exe
        5⤵
        
        PID:7376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14678.exe
        6⤵
        
        PID:14428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47330.exe
        6⤵
        
        PID:17580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55612.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35793.exe
        5⤵
        
        PID:14316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25296.exe
        5⤵
        
        PID:14784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22285.exe
        5⤵
        
        PID:7208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37160.exe
      4⤵
      PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29925.exe
        5⤵
        
        PID:11688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51746.exe
        5⤵
        
        PID:16528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37278.exe
      4⤵
      PID:10864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52811.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23525.exe
      4⤵
      PID:17452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12106.exe
      4⤵
      PID:12464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42834.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42834.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53876.exe
      4⤵
      PID:6436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29092.exe
        5⤵
        
        PID:8148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20771.exe
        6⤵
        
        PID:13052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53692.exe
        6⤵
        
        PID:15160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15731.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-380.exe
        5⤵
        
        PID:14500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58456.exe
        5⤵
        
        PID:18284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46597.exe
        5⤵
        
        PID:7632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10378.exe
      4⤵
      PID:8348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34510.exe
      4⤵
      PID:11720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25872.exe
      4⤵
      PID:15188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57165.exe
      4⤵
      PID:548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43952.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43952.exe
    3⤵
    PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3194.exe
      4⤵
      PID:14408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54398.exe
      4⤵
      PID:17996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28410.exe
      4⤵
      PID:12036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52544.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52544.exe
    3⤵
    PID:804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35764.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35764.exe
    3⤵
    PID:13056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50543.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50543.exe
    3⤵
    PID:15720
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8991.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8991.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7913.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7913.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17618.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48474.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56424.exe
        6⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14535.exe
        7⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48783.exe
        8⤵
        
        PID:12636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-407.exe
        8⤵
        
        PID:16660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24358.exe
        7⤵
        
        PID:9444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55673.exe
        7⤵
        
        PID:12948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        7⤵
        
        PID:15572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11966.exe
        6⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55919.exe
        7⤵
        
        PID:7048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        6⤵
        
        PID:10444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6893.exe
        6⤵
        
        PID:15820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31821.exe
        6⤵
        
        PID:16240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38240.exe
        6⤵
        
        PID:18380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20990.exe
        5⤵
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56720.exe
        6⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40553.exe
        7⤵
        
        PID:13772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44538.exe
        7⤵
        
        PID:17236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16333.exe
        6⤵
        
        PID:9788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7396.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10469.exe
        6⤵
        
        PID:14096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38821.exe
        6⤵
        
        PID:7152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16931.exe
        5⤵
        
        PID:8076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37356.exe
        5⤵
        
        PID:11400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57272.exe
        5⤵
        
        PID:15092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57695.exe
        5⤵
        
        PID:17912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26683.exe
        5⤵
        
        PID:1660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22386.exe
      4⤵
      Executes dropped EXE
      PID:5016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6984.exe
        5⤵
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53762.exe
        6⤵
        
        PID:3668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45830.exe
        6⤵
        
        PID:13148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55751.exe
        6⤵
        
        PID:16712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20241.exe
        6⤵
        
        PID:12516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60295.exe
        5⤵
        
        PID:9148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56765.exe
        5⤵
        
        PID:13064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60344.exe
        5⤵
        
        PID:4472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4348.exe
        5⤵
        
        PID:7044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34725.exe
      4⤵
      PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52418.exe
        5⤵
        
        PID:7888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21953.exe
        5⤵
        
        PID:10356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-572.exe
        5⤵
        
        PID:15112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27739.exe
        5⤵
        
        PID:956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21426.exe
      4⤵
      PID:6528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51747.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57272.exe
      4⤵
      PID:15296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51037.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51037.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23778.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56424.exe
        5⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30524.exe
        6⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29925.exe
        7⤵
        
        PID:11244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61860.exe
        7⤵
        
        PID:16468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26688.exe
        6⤵
        
        PID:9072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59565.exe
        6⤵
        
        PID:13024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
        6⤵
        
        PID:16684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7690.exe
        5⤵
        
        PID:6776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12602.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53692.exe
        6⤵
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2534.exe
        6⤵
        
        PID:7196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60411.exe
        5⤵
        
        PID:10180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43640.exe
        5⤵
        
        PID:13428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1804.exe
        5⤵
        
        PID:4892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11260.exe
      4⤵
      PID:5744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14792.exe
        5⤵
        
        PID:11056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45960.exe
        5⤵
        
        PID:14756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44999.exe
        5⤵
        
        PID:15468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21481.exe
        5⤵
        
        PID:17540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3818.exe
        5⤵
        
        PID:3192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33843.exe
      4⤵
      PID:7584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60988.exe
      4⤵
      PID:11512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8270.exe
      4⤵
      PID:15272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2828.exe
      4⤵
      PID:11748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56542.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56542.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1193.exe
      4⤵
      PID:5144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35340.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29863.exe
        6⤵
        
        PID:14228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13235.exe
        6⤵
        
        PID:16780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42783.exe
        5⤵
        
        PID:10044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33874.exe
        5⤵
        
        PID:3992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35208.exe
        5⤵
        
        PID:17524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59413.exe
      4⤵
      PID:7708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52203.exe
        5⤵
        
        PID:14636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7335.exe
        5⤵
        
        PID:18044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51570.exe
        5⤵
        
        PID:3608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41335.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41658.exe
      4⤵
      PID:14324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42453.exe
      4⤵
      PID:14652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27739.exe
      4⤵
      PID:18420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26201.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26201.exe
    3⤵
    PID:5920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49704.exe
      4⤵
      PID:7676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6114.exe
      4⤵
      PID:11948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-983.exe
      4⤵
      PID:15380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18045.exe
      4⤵
      PID:6264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12761.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12761.exe
    3⤵
    PID:7960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35211.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35211.exe
    3⤵
    PID:11296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60139.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60139.exe
    3⤵
    PID:15476
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3564.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3564.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13258.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13258.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2179.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15968.exe
        5⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18620.exe
        6⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29863.exe
        7⤵
        
        PID:14264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58160.exe
        7⤵
        
        PID:17352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44971.exe
        6⤵
        
        PID:9248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55673.exe
        6⤵
        
        PID:13132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        6⤵
        
        PID:1072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3798.exe
        5⤵
        
        PID:7524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20133.exe
        6⤵
        
        PID:14344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3661.exe
        6⤵
        
        PID:17648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        5⤵
        
        PID:10560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6893.exe
        5⤵
        
        PID:15828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25988.exe
        5⤵
        
        PID:18256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59693.exe
      4⤵
      PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49678.exe
        5⤵
        
        PID:8876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45830.exe
        5⤵
        
        PID:13140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26970.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17507.exe
      4⤵
      PID:8104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22525.exe
        5⤵
        
        PID:13264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-407.exe
        5⤵
        
        PID:2420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37345.exe
        5⤵
        
        PID:17472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5836.exe
      4⤵
      PID:12124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8856.exe
        5⤵
        
        PID:18172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56094.exe
      4⤵
      PID:15684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51379.exe
      4⤵
      PID:2796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43980.exe
      4⤵
      PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12049.exe
        5⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7086.exe
        6⤵
        
        PID:14620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33096.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26688.exe
        5⤵
        
        PID:1456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2196.exe
        5⤵
        
        PID:12988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15923.exe
        5⤵
        
        PID:16476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11774.exe
      4⤵
      PID:7004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-402.exe
        5⤵
        
        PID:7360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
        5⤵
        
        PID:12852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27739.exe
        5⤵
        
        PID:4556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39991.exe
      4⤵
      PID:10076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47148.exe
      4⤵
      PID:11364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1804.exe
      4⤵
      PID:14680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18585.exe
      4⤵
      PID:8720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42537.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42537.exe
    3⤵
    PID:6028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61598.exe
      4⤵
      PID:1444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11476.exe
        5⤵
        
        PID:11500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62872.exe
        5⤵
        
        PID:15152
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15152 -s 464
        6⤵
        Program crash
        
        PID:18156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59965.exe
        5⤵
        
        PID:18012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16382.exe
      4⤵
      PID:8752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59565.exe
      4⤵
      PID:12940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59862.exe
      4⤵
      PID:15128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10841.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10841.exe
    3⤵
    PID:7000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39183.exe
      4⤵
      PID:14940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47408.exe
      4⤵
      PID:17788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42035.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42035.exe
    3⤵
    PID:9872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7072.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7072.exe
    3⤵
    PID:14156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64815.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64815.exe
    3⤵
    PID:14812
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55750.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55750.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44390.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44390.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6984.exe
      4⤵
      PID:6024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49704.exe
        5⤵
        
        PID:7620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15254.exe
        6⤵
        
        PID:14436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        6⤵
        
        PID:6704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6114.exe
        5⤵
        
        PID:11940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-983.exe
        5⤵
        
        PID:15364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18045.exe
        5⤵
        
        PID:17508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53278.exe
      4⤵
      PID:8488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33744.exe
      4⤵
      PID:11876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5165.exe
      4⤵
      PID:14176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45853.exe
      4⤵
      PID:17840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8245.exe
      4⤵
      PID:17504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8354.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8354.exe
    3⤵
    PID:5568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19258.exe
      4⤵
      PID:6848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56502.exe
        5⤵
        
        PID:7724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22529.exe
        5⤵
        
        PID:11152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62409.exe
        5⤵
        
        PID:15508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24231.exe
        5⤵
        
        PID:5608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45957.exe
      4⤵
      PID:9024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27878.exe
      4⤵
      PID:11376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51310.exe
      4⤵
      PID:16604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47108.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47108.exe
    3⤵
    PID:6164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14792.exe
      4⤵
      PID:11040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31569.exe
      4⤵
      PID:14724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44999.exe
      4⤵
      PID:5048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17397.exe
      4⤵
      PID:17880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40191.exe
      4⤵
      PID:17516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
    3⤵
    PID:9320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52873.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52873.exe
    3⤵
    PID:13336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48091.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48091.exe
    3⤵
    PID:1080
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16786.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16786.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56424.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56424.exe
    3⤵
    PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2921.exe
      4⤵
      PID:6808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60560.exe
        5⤵
        
        PID:1988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45830.exe
        5⤵
        
        PID:13176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18610.exe
        5⤵
        
        PID:17220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56647.exe
      4⤵
      PID:7616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1236.exe
      4⤵
      PID:11668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34398.exe
      4⤵
      PID:15120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-756.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18201.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:17884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37456.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37456.exe
    3⤵
    PID:6128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48119.exe
      4⤵
      PID:14508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18138.exe
      4⤵
      PID:18004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55654.exe
      4⤵
      PID:6756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
    3⤵
    PID:9368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40175.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40175.exe
    3⤵
    PID:14284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18673.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18673.exe
    3⤵
    PID:17412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21322.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21322.exe
    3⤵
    PID:2616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17820.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17820.exe
    3⤵
    PID:6504
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62606.exe
  2⤵
  PID:5760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45904.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45904.exe
    3⤵
    PID:6488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22696.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22696.exe
    3⤵
    PID:11112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40943.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40943.exe
    3⤵
    PID:14980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49976.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49976.exe
    3⤵
    PID:17544
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49347.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49347.exe
  2⤵
  PID:7716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63365.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63365.exe
    3⤵
    PID:10740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-407.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-407.exe
    3⤵
    PID:16568
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51093.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51093.exe
  2⤵
  PID:1028
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10857.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10857.exe
  2⤵
  PID:14308
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48004.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48004.exe
  2⤵
  PID:16880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5892 -ip 5892
1⤵
PID:17364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 14508 -ip 14508
1⤵
PID:18396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5104 -ip 5104
1⤵
PID:2316

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Modifies data under HKEY_USERS
PID:18416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
- Suspicious behavior: AddClipboardFormatListener
PID:5508

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11587.exe

Filesize
468KB

MD5
77b6183b0a669a4506ba49af1e91ed20

SHA1
cb3a1b900e75a85252e257e719da5730d74834d3

SHA256
3bced30dde48186552ae7dd1a29ba80ac83e2b10e05da9a649938cad2101eeae

SHA512
ef0cf579c72c9173627a5372a0e692a99b1b218d9e88d17b420b0379070ae3bd069d2901fd5bb2c183d24f8f3844689a1d3db95e11a1d3cfe2ce03d7d8502d92

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13258.exe

Filesize
468KB

MD5
5ea9d57a09e9ba0c313af551da48590e

SHA1
d9a1deb939b6a298c8b7c341d9b7a52d5b79ef9d

SHA256
c16ba984a7d73e080bb07e3a732679f3531425932673314413d9ba37b87d23cd

SHA512
713a2fbc0435cfd71f1d53095c88164345dcbb2d395cf1bd9bc93db59691d1287621a3a666fdbdb2c6c3af6cf46a7a6b6d3632926484482506dc70c73f1c6a69

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16082.exe

Filesize
468KB

MD5
18d4dcb15054b9568ce93afd7d29954a

SHA1
43abdc3c52eaefff7c288ffc51f5f4d98b37ce0c

SHA256
14fe1522c9b4dd04d499600da920fed1aeab4c6817fefec76b1275804a51530c

SHA512
06bc6b3ac5ad2d58a5afb97d6228008ccd0d864a7e2c7575617155d1aa1b35a0f6bbb9e51d9d79ff0e5867a04fb242e3c43e572335faedba009f139d4fdd8e23

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17260.exe

Filesize
468KB

MD5
ae00df1ebbc24aeb52b816a758b42166

SHA1
ad30e93502240835b0166f96878c7b91299383d5

SHA256
8b8eb47887dd3ef9b3b0b86b6962f8d4d78440fdf445bd9b58a0cd30b8f8379c

SHA512
479f9d704f85d2ed0b5c68f9d5f591372c43b4a3886cc51cb78c25b8d6461a4a106528845bc45b38e9cd2a0fa574b4e642052c4c1c86814f5fadcafd54f3f4ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17618.exe

Filesize
468KB

MD5
3632d22cadc35db0e649bd6246d6257d

SHA1
bcaa481a9cc5fcf848b4818cd4a3d7ac3afebbba

SHA256
d2c0b0d669764122417d64e0d953ee11430971ddd46f2131b676b5d10c1d2122

SHA512
3093a840ca3f115292f4057dc80fe6963936d489b4c10f63abdfb8b0cb2eeaf7f167db8712568e4dc9273198abcf9662c13489866ba57a23a6c004c55015bcc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1783.exe

Filesize
468KB

MD5
a5ee9626db7eeb7ecbd49b26d008e1c8

SHA1
af73fc6801cc8b97a9801c2e30c66d9514f82821

SHA256
0c02d3093da673f9322c0edf1d62f42614b7d1e6dab3d8022a8dc08acc11db33

SHA512
b9e7c710f28c189444a48d226786d07c2c8a8cb052d60b5f510ff1a097a60209a10f6c682431678b55dc814cc0487f3a982f96dd10dd2aa9a9da1ab4bd8a6782

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21618.exe

Filesize
468KB

MD5
01fdef3350749f0870703fa2acba9db7

SHA1
662f05a103f2e185abb9edf4c9e0206e66222a78

SHA256
5bf5b9531d12db535507e7d4b16c448f1909874d1c3ffddaf844951ecbc4b6e3

SHA512
3b973cb6ee8bebf7da83ff0d9d36b515b05b9ac9c11d4362d65205f58d9c7496cb2788bec3bdffa553aba09a5179ab4db542ed1a7bfe22e47eb3d64eb529a6a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22304.exe

Filesize
468KB

MD5
2c912437f5a7518abf2f69b84d6753d0

SHA1
a508def546913dd50c72dc4970d2e2edb7701104

SHA256
5acc2fc2d51d9800b478b0ffff559ba3f7f5018ab3b625881fb63ca61de1a03c

SHA512
3a44acb92f9b83cb743df5b8f4a3bd6c5239059e655164434853305ffa8b212e04f1a58cb31b9c39813b576bd856ce7a973de907c2417be0e387360de8ec50cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23010.exe

Filesize
468KB

MD5
3a6223e4fc8ba8df7d1bdb3cf5c155eb

SHA1
2caebbce3dd076929197e1d137051beddc72f4aa

SHA256
1c0c939ccc1bbe1cfe3bfb67320a0dbdf584234279b21db0b81d9ad0aac3d3ac

SHA512
1631dafa746eea0ddbff2d0c424c762c4d3875f21b6f842da1431f0fa60ca368797674952bce807bb48dbfe68d644eb44e97cedfd1afdd783f59efc5e4d92d7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26632.exe

Filesize
468KB

MD5
e4404b40fc63a5a025d0d0eefdc73815

SHA1
7a7a851e3e6aa8b7b05763c679100733babb7c9d

SHA256
c5c776802289b2cdbfbc394966c78e13669ea7bf57a1cce12678432279a94248

SHA512
2313b175f8a391fed56d5c4d6bf04f2b902159d59acd969a937c1fd688da2e3b21f5582b93245e1b7f7b2b0ce350ae4ed4240dd76af6106c270804dceb03ea1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29577.exe

Filesize
468KB

MD5
1b8bb9212f2b627a51ada9e9153cce9b

SHA1
821ab12147bb10c4eee715cca951c4b10447dde8

SHA256
feefe096a5d43890369866c90acc7303129d8933ba0fdad6a5f276c66156032c

SHA512
aadbab113481d6e728acc892637f9688b9c518b087169546fec21c0888b2d017f95882d87758606e64dd46f95afbfaabe870d7217b78f5eee95e4184583afe0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3564.exe

Filesize
468KB

MD5
57f039fd7c59aa200c8e172e3a9a81a4

SHA1
9776bf98fb91b23482db20b698b06e49c04eb9ee

SHA256
d6f591d89432d146852ddc19efed8cd19d166745f1f9ffcb9d08efd2c26c1d2b

SHA512
5b36f71515e92048145f504583777af0b24be56cfe77cb3652a326b9a9056ad8f6ba66a2c1001f5c3eb3c5ed904a1789a6746f98fc97bec19fda650614c81189

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35734.exe

Filesize
468KB

MD5
74171c7b73792eb31982e8760c4eca09

SHA1
55fab26abc07b7b8ccc596cbfae043ea0dc532c7

SHA256
8f4bec49e52767db99f2e8275e7123fc8f9376456238bb0a44f70f078a2f8c0d

SHA512
f84088e9f384164a7a1bd095dbba7adba1e0856f04b17a824859df03f093a36adb8bfc09d24449fe39caccd53ac2f106024f09e4a7dff15e42265a0328402dc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35827.exe

Filesize
468KB

MD5
60e841adab70473d323dfbeb2e97dc0b

SHA1
6da15b0bbf19df8a374ea71b64f3300d4f70b6de

SHA256
24736957ee1f32adf4990f5e2d54f0ca4f3b600da1b052e0d7f1b578098a0c1a

SHA512
214b8e32445fcdf2663465370a69ead542c94b1e95e9484901dbcd4fa7e1d5935a0e2bc83983060efb7c7054f413c5e746b74ac9e852af088c4e090faf18affd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39792.exe

Filesize
468KB

MD5
12e4966e4b346e7d38c91a0dee59a080

SHA1
da707237e87ef0feca6476e8f7565fe492fb8b42

SHA256
f65097ebe652afa7bf50229247c85f5d8678307bb38f903097bec5e4cdaf0755

SHA512
c2c9a446e4f7f38e4b998ddcd3e24df801b1913f4e82db9a64bfb422bb64fcc3c5f2f18a0ccdd12feb94ea528f1bff82af9d9ad11fc7ca4d2a96be3f6bb9cf48

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44260.exe

Filesize
468KB

MD5
62bf61559ad012b9b63ceea187587307

SHA1
0bf0ff03b63fddad2fb796d100d99100a69f7b9f

SHA256
c7a67473007e6fb444b1e336936f63de2e33fdc0c99758800fa21f3fa813f9ab

SHA512
36dd9931ae6d543e6e79d9b1ba2fef229568a98bf130f6b7b53a48dbea8884253363734e2fdffc8256a9d25a6a96c86a28e28ec0f41be916a079bf76574876d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44815.exe

Filesize
468KB

MD5
928a1de0b861894311dc95096f26cdaf

SHA1
77c9100a6363410d07eb98f354997f2cb609a972

SHA256
68912798c574129e93d35d021106870884a76c77b040fc9b85bd857170a75e02

SHA512
83565970f5d1306538f01ef0a661df4028636bd091802f6d9cdd691c2808226100695b7a3f26ad470fe188bc40d092afdc0734fbc7c8a54560c47697c5c375a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45384.exe

Filesize
468KB

MD5
5b67a18c0d33dd6c9eed8531e4b6ee05

SHA1
499dd3823513a704ecfee4c40ff19b80c1c33d7a

SHA256
1c7c7e58b268533803a56556be759e9708a04343128531d9bcb75c9c72ba3592

SHA512
b50925bd8e17e10baf0a15945be87a10c2237b14b48e55e2e23cd286a187fd1a433b340954f29deb5a17117a372cfbdd9bb9b8df6fa40a741d9fe002b9620735

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49091.exe

Filesize
468KB

MD5
6688b2c067ee64def74ee19ad6ecbe41

SHA1
390c2f08e9150118d9baffc72fe40ca5eec498a8

SHA256
54529707a3c721a70a75d52b570201dc4b1074c35ab01e4db047ba62c890ee21

SHA512
ec23efa2b8ac849cfcea73cb8e5d4d245dc3663c08b5d5ca4682751ddb0d7088d3278884e15185f217d81d1061cef6c3c2737c316d8429548a8d0abcdc79154b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49730.exe

Filesize
468KB

MD5
312cddb6ac86d94b68b1c25cc6b569d2

SHA1
0f5a6d9660e4765fbc5293f60fade2ae333bebd4

SHA256
610d36b9e6b6f5eab4747137eb6ca4bbac95924b772704412709b42e49b7f978

SHA512
5bb37fae620b33986dfbf1ab42cd488c72c0165bf1cabeb91ca4cbfbf417ed41ed33788a1e4e204ae098dada00a99bbb62905e214d2cc0f2725a1c3cfded7500

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51037.exe

Filesize
468KB

MD5
400814d0dcf097b2304d59f20986c004

SHA1
a434aa13c07c6d99ff07b46b25f610ffb44c6071

SHA256
a9775d256919fb747e311baab0e0b5917362b6d674f8e448f61eec6f4b4f5260

SHA512
2f52084fce86dd1cd14fe7b17b72af3be1a6d88bc70b6ce50a89b6ee6ec3f637219d8ba09f5521a08b3259d0aa9f17caab163d6ec6597ca58e04bee7c150b40d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5225.exe

Filesize
468KB

MD5
bcc9f774ce1fece4cb0cf20e1bc16832

SHA1
0afdd89d3bc83f439cc18c6301fc9968f203fd0e

SHA256
e16b307797c6dd9e2482a9f8f59c5799c943eded8957259bc30bf17d9ccde7fa

SHA512
946ce68795e293cd21713e228d9b1a70ace315ae1c4a12179169f2a9206384fbaf053fe5a4c7e266f259ebdfe79b812accf0b34d9e7e10debbd766383fe394ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55750.exe

Filesize
468KB

MD5
cace228b16cb619e5361b49de05ce879

SHA1
d674f88915b8c91cc91bde8ff7e3e1309c7c5659

SHA256
3df97ba3f3d702d862fe422e864012b0012c19ce9e219c553b5d84db339498b0

SHA512
4bee10cc5274a85aaa172374cfd8cd24e833cabac3e2d8dce7e572a69887586b5fb654c42a3145a8b9d1e0f76dbc49a0f4a3216e2b7b59b37dd5c57826adf057

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58266.exe

Filesize
468KB

MD5
5d32d5c69e2e2a49f03a874030849ec0

SHA1
69f0071e88d87bca41308fe8dabfe7909ccccbb3

SHA256
76f5a43e66cf16dc0b04d792821b65cd229396987d4a315437bc1258f9689bc0

SHA512
80581bd57565d952816e2a5487a08350e445aa026faf0008f04aee24c3609001e5ada244742d009b2db2722652a18f613a0d0c72434eeccf21e3ee1b7f83b71c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59807.exe

Filesize
468KB

MD5
e30f37652961881a79574cfd64e2795a

SHA1
ee8db82719f0968447b2bfce3efada812c24109e

SHA256
299e520a0bab8faf06164464554a83b501ea51cbaeab101e5a054d44b87cd78f

SHA512
420fcecfa2ee392274a0108193c974c12a1b7ba8d0fb262fea038f8b6ee0da6f626420640462107f25f6cc4de2c6ea1745b45e5ba418ea1f55a92be9a017eaa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62905.exe

Filesize
468KB

MD5
66b6d18b6d8f943b80e9056f59ea84ce

SHA1
341a1bb24a45343e0b96672be96f127b20a51f6f

SHA256
ca60dea5350f72eb757f151a46c28199d70a4d7ba1319f8130a682a2cfcbef61

SHA512
0d41db3bde12cfb9cca48615aa9d89d5e04e615159d070cd59ca95626152882c2225583a98597191747fa0ed9f10cbb74aac45fbd7c191d646b298f742f324f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63336.exe

Filesize
468KB

MD5
8ac8de3066e53720457a0d9bc69fc4e9

SHA1
46614165f4c75caba1c8f92ac5fff337babbd88e

SHA256
f1d1af0a33591a57fb8c6b0c9669a00fc1d63d61f2969049ccefcb480516fd0f

SHA512
f4c51e853447569640313ffcfa3c4f178673f5cd4988bda5a70e03812b1312582dc6833beabecb91e4a00bc706f94797f6eacabfcc99858bd1125e3ffea63d0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63891.exe

Filesize
468KB

MD5
9e73746d07440ba42bf0123033eadbf9

SHA1
52acc9c7f7b381b09245b14e19380f6699c453b5

SHA256
e845b568a3dc93a298faff033a3b25461b154eee4e74a098b83174ebc0314c96

SHA512
ee8699ee578825880c624bfb3a0e4e5700d1e7b118dc4551e44428408aca2820e7ef79b05599c5b93c8b2055625c6989703c70143fed4503c8f7dcb8d50751e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7913.exe

Filesize
468KB

MD5
bb8405fdf6b36ee8c8593f442e045809

SHA1
02fbd41650fcb0627651eceeb77d892e1bfcc7c2

SHA256
4cfb81ce100887e0881f284f1030c72b9151d3397105228259048d1f26685f40

SHA512
5be592deed3a78b803c8a3f14ba6d59b31a680a796dbe2072ee52c1bf0d6b215acd6324f79709036058594f9b773b15195a96005e0dfac8704da1b9ddb9aca96

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8991.exe

Filesize
468KB

MD5
6ed333dbb9f9200538295733210d04e4

SHA1
a5a820aa461d865f37485f44fe95f8bf5f70c007

SHA256
82b0cb73f8cc3cc35dcc9adf794feb444af92aff4840810c56ded9adc7abd9a0

SHA512
a9600e57f4a9b8ef53c2d39da416766a642118979532562eaf048ef95ac9af48e6f4a5328ccefb48f88057c605c7a46ba70064be9426a77b38605259674c1345

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9449.exe

Filesize
468KB

MD5
ccc0fed314a29b6c77a81dc1a0571884

SHA1
7b1a2ad7a59ddcfc08b5aaa98fb65059235c31bc

SHA256
967263412791676e35ceef48677af33265fc9ef2e663236374be605161dacea5

SHA512
9bf003fbb0902d5462f6674c956379584f0563044869f3c1cc23faaa54a947fe8e0ed8d99c85ed60dd91d433524e3d3d726dce14f17a4212401be32439743354

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9646.exe

Filesize
468KB

MD5
0c9c79b1643be4d9e714ad6479fc2e81

SHA1
95eb3e8a4d2659a8e07985771798c07636f502e8

SHA256
53c27403886600cd7a289f19e25d33b2219b851f898f17c20c8a4fe272faa45a

SHA512
83451fc4a4daf2f21f1098ccef2feb75cc6685e5394276e7692d5e191980bdc799d7b9c29c1d0a5956a34d827df1578ffc99cd3b7dcf8e3c5e7998837a7c4eb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9733.exe

Filesize
468KB

MD5
078a037b7783074405681f3c4b6dabe0

SHA1
727b105fdbac2e5b97267f42db57a69296d9c023

SHA256
0e924e2216970a49a7aaaf25fe60b0640ce055d10e7f588671101c25e5baaa31

SHA512
54f66cf5e95c6be332f84ca8a998e1aded0f510c3c1ffad9a13f773db7a6bfae6b65852f9371ac6d2f0c435acbac525c1d0b455a2ca350b227cf23a186398b1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9864.exe

Filesize
468KB

MD5
a101cdaf4f98af1cbc267397adbf4d90

SHA1
65d14656f91e8752d73e3e7e5fb1c30cd7ad134f

SHA256
5bff5ce08fa0ac4ff1a520a4991705af006a6a647c801caddeb2454ff430c60b

SHA512
89e524ff17b10269b5094ca11f41fdaa4ba1aee3bebface5460ddb41d2ce2a801f0f217f2dec10bbd0deda7736046d026647d677adc4726616467ec632b8c16c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads