31ab7acae065351959893cf0282095629beaa27457d938f2ff7d4674f7323c66

Analysis

max time kernel
119s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31ab7acae065351959893cf0282095629beaa27457d938f2ff7d4674f7323c66N.exe
Size

468KB
MD5

c55f71a74aa5e5ea30f26843d2cb85b0
SHA1

a0e391fe88cc8b179d815e3a4adf3bd42f3235ff
SHA256

31ab7acae065351959893cf0282095629beaa27457d938f2ff7d4674f7323c66
SHA512

70c91024fdc230d66f52c0adc53827a4cdc4801e1cdf1c32caf14a2fc7555552c8f0ec025e2df02e567540cd6635faca0ffd38b2fbcf7850069334016d9f634b
SSDEEP

3072:tPyJoKWwzf8u2bYH8z1jcfr/mmuM7wpjnmHevVyv2/RnIryQU0lF:tP4oaku2w85jcfXMF22/56yQU

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4544	Unicorn-13974.exe
3920	Unicorn-62703.exe
2952	Unicorn-42837.exe
1812	Unicorn-1582.exe
2540	Unicorn-28700.exe
1392	Unicorn-10326.exe
3060	Unicorn-55998.exe
3152	Unicorn-12542.exe
2852	Unicorn-33709.exe
4884	Unicorn-37623.exe
2416	Unicorn-21021.exe
244	Unicorn-4950.exe
1820	Unicorn-42453.exe
3368	Unicorn-54151.exe
2444	Unicorn-31300.exe
3628	Unicorn-62807.exe
3508	Unicorn-33621.exe
4944	Unicorn-37535.exe
588	Unicorn-22852.exe
3612	Unicorn-31095.exe
3968	Unicorn-31095.exe
5084	Unicorn-3061.exe
1832	Unicorn-55791.exe
1848	Unicorn-55526.exe
1356	Unicorn-30903.exe
4860	Unicorn-14566.exe
868	Unicorn-5636.exe
848	Unicorn-49469.exe
2400	Unicorn-35733.exe
2552	Unicorn-35733.exe
3864	Unicorn-31404.exe
4980	Unicorn-60739.exe
4984	Unicorn-30252.exe
5000	Unicorn-7785.exe
2228	Unicorn-12882.exe
3516	Unicorn-65228.exe
1924	Unicorn-7978.exe
5008	Unicorn-8243.exe
4540	Unicorn-36426.exe
2052	Unicorn-7475.exe
216	Unicorn-15836.exe
3088	Unicorn-55259.exe
1844	Unicorn-28153.exe
3104	Unicorn-1227.exe
2732	Unicorn-16794.exe
5096	Unicorn-42260.exe
4184	Unicorn-17756.exe
2212	Unicorn-22970.exe
5060	Unicorn-18332.exe
1200	Unicorn-12201.exe
2916	Unicorn-58980.exe
3392	Unicorn-39114.exe
2984	Unicorn-34476.exe
1284	Unicorn-34476.exe
4920	Unicorn-12009.exe
2216	Unicorn-651.exe
1956	Unicorn-58020.exe
3232	Unicorn-38154.exe
3624	Unicorn-46131.exe
1556	Unicorn-194.exe
1104	Unicorn-57066.exe
3168	Unicorn-14403.exe
3412	Unicorn-6235.exe
2028	Unicorn-49690.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
14788	12436	WerFault.exe	641
14804	14060	WerFault.exe	665
5588	16704	WerFault.exe	878
7472	17292	WerFault.exe	921
7460	16792	WerFault.exe	885

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1762.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42292.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48875.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29855.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27055.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45658.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58275.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48850.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10329.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38378.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46840.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27055.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38488.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39986.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20860.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8289.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17042.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49307.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21952.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10527.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33074.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28586.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58321.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16393.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13327.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50795.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11377.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35607.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2017.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18468.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38488.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60801.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49369.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3711.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41124.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20860.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27913.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52441.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19768.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24562.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48985.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42242.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30427.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41963.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24849.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58961.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22852.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49059.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5735.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4241.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62971.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24617.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60282.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5735.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41963.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3061.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46131.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26650.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17096	dwm.exe
Token: SeChangeNotifyPrivilege	17096	dwm.exe
Token: 33	17096	dwm.exe
Token: SeIncBasePriorityPrivilege	17096	dwm.exe
Token: SeCreateGlobalPrivilege	6500	dwm.exe
Token: SeChangeNotifyPrivilege	6500	dwm.exe
Token: 33	6500	dwm.exe
Token: SeIncBasePriorityPrivilege	6500	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3592	31ab7acae065351959893cf0282095629beaa27457d938f2ff7d4674f7323c66N.exe
4544	Unicorn-13974.exe
2952	Unicorn-42837.exe
3920	Unicorn-62703.exe
1812	Unicorn-1582.exe
2540	Unicorn-28700.exe
3060	Unicorn-55998.exe
1392	Unicorn-10326.exe
3152	Unicorn-12542.exe
2852	Unicorn-33709.exe
4884	Unicorn-37623.exe
2416	Unicorn-21021.exe
2444	Unicorn-31300.exe
244	Unicorn-4950.exe
3368	Unicorn-54151.exe
1820	Unicorn-42453.exe
3628	Unicorn-62807.exe
3508	Unicorn-33621.exe
4944	Unicorn-37535.exe
588	Unicorn-22852.exe
3612	Unicorn-31095.exe
5084	Unicorn-3061.exe
3968	Unicorn-31095.exe
1832	Unicorn-55791.exe
868	Unicorn-5636.exe
1848	Unicorn-55526.exe
2552	Unicorn-35733.exe
4860	Unicorn-14566.exe
1356	Unicorn-30903.exe
2400	Unicorn-35733.exe
848	Unicorn-49469.exe
3864	Unicorn-31404.exe
4980	Unicorn-60739.exe
4984	Unicorn-30252.exe
5000	Unicorn-7785.exe
2228	Unicorn-12882.exe
3516	Unicorn-65228.exe
1924	Unicorn-7978.exe
5008	Unicorn-8243.exe
4540	Unicorn-36426.exe
2052	Unicorn-7475.exe
216	Unicorn-15836.exe
3088	Unicorn-55259.exe
1844	Unicorn-28153.exe
3104	Unicorn-1227.exe
5096	Unicorn-42260.exe
2732	Unicorn-16794.exe
4184	Unicorn-17756.exe
5060	Unicorn-18332.exe
2212	Unicorn-22970.exe
2984	Unicorn-34476.exe
2916	Unicorn-58980.exe
1200	Unicorn-12201.exe
3392	Unicorn-39114.exe
1284	Unicorn-34476.exe
4920	Unicorn-12009.exe
2216	Unicorn-651.exe
1956	Unicorn-58020.exe
1556	Unicorn-194.exe
3624	Unicorn-46131.exe
3232	Unicorn-38154.exe
1104	Unicorn-57066.exe
3168	Unicorn-14403.exe
3412	Unicorn-6235.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 4544	3592	31ab7acae065351959893cf0282095629beaa27457d938f2ff7d4674f7323c66N.exe	82
PID 3592 wrote to memory of 4544	3592	31ab7acae065351959893cf0282095629beaa27457d938f2ff7d4674f7323c66N.exe	82
PID 3592 wrote to memory of 4544	3592	31ab7acae065351959893cf0282095629beaa27457d938f2ff7d4674f7323c66N.exe	82
PID 4544 wrote to memory of 3920	4544	Unicorn-13974.exe	87
PID 4544 wrote to memory of 3920	4544	Unicorn-13974.exe	87
PID 4544 wrote to memory of 3920	4544	Unicorn-13974.exe	87
PID 3592 wrote to memory of 2952	3592	31ab7acae065351959893cf0282095629beaa27457d938f2ff7d4674f7323c66N.exe	88
PID 3592 wrote to memory of 2952	3592	31ab7acae065351959893cf0282095629beaa27457d938f2ff7d4674f7323c66N.exe	88
PID 3592 wrote to memory of 2952	3592	31ab7acae065351959893cf0282095629beaa27457d938f2ff7d4674f7323c66N.exe	88
PID 2952 wrote to memory of 1812	2952	Unicorn-42837.exe	90
PID 2952 wrote to memory of 1812	2952	Unicorn-42837.exe	90
PID 2952 wrote to memory of 1812	2952	Unicorn-42837.exe	90
PID 3592 wrote to memory of 2540	3592	31ab7acae065351959893cf0282095629beaa27457d938f2ff7d4674f7323c66N.exe	91
PID 3592 wrote to memory of 2540	3592	31ab7acae065351959893cf0282095629beaa27457d938f2ff7d4674f7323c66N.exe	91
PID 3592 wrote to memory of 2540	3592	31ab7acae065351959893cf0282095629beaa27457d938f2ff7d4674f7323c66N.exe	91
PID 3920 wrote to memory of 1392	3920	Unicorn-62703.exe	92
PID 3920 wrote to memory of 1392	3920	Unicorn-62703.exe	92
PID 3920 wrote to memory of 1392	3920	Unicorn-62703.exe	92
PID 4544 wrote to memory of 3060	4544	Unicorn-13974.exe	93
PID 4544 wrote to memory of 3060	4544	Unicorn-13974.exe	93
PID 4544 wrote to memory of 3060	4544	Unicorn-13974.exe	93
PID 1812 wrote to memory of 3152	1812	Unicorn-1582.exe	96
PID 1812 wrote to memory of 3152	1812	Unicorn-1582.exe	96
PID 1812 wrote to memory of 3152	1812	Unicorn-1582.exe	96
PID 2952 wrote to memory of 2852	2952	Unicorn-42837.exe	97
PID 2952 wrote to memory of 2852	2952	Unicorn-42837.exe	97
PID 2952 wrote to memory of 2852	2952	Unicorn-42837.exe	97
PID 2540 wrote to memory of 4884	2540	Unicorn-28700.exe	98
PID 2540 wrote to memory of 4884	2540	Unicorn-28700.exe	98
PID 2540 wrote to memory of 4884	2540	Unicorn-28700.exe	98
PID 3592 wrote to memory of 2416	3592	31ab7acae065351959893cf0282095629beaa27457d938f2ff7d4674f7323c66N.exe	99
PID 3592 wrote to memory of 2416	3592	31ab7acae065351959893cf0282095629beaa27457d938f2ff7d4674f7323c66N.exe	99
PID 3592 wrote to memory of 2416	3592	31ab7acae065351959893cf0282095629beaa27457d938f2ff7d4674f7323c66N.exe	99
PID 1392 wrote to memory of 244	1392	Unicorn-10326.exe	100
PID 1392 wrote to memory of 244	1392	Unicorn-10326.exe	100
PID 1392 wrote to memory of 244	1392	Unicorn-10326.exe	100
PID 3920 wrote to memory of 1820	3920	Unicorn-62703.exe	101
PID 3920 wrote to memory of 1820	3920	Unicorn-62703.exe	101
PID 3920 wrote to memory of 1820	3920	Unicorn-62703.exe	101
PID 3060 wrote to memory of 3368	3060	Unicorn-55998.exe	102
PID 3060 wrote to memory of 3368	3060	Unicorn-55998.exe	102
PID 3060 wrote to memory of 3368	3060	Unicorn-55998.exe	102
PID 4544 wrote to memory of 2444	4544	Unicorn-13974.exe	103
PID 4544 wrote to memory of 2444	4544	Unicorn-13974.exe	103
PID 4544 wrote to memory of 2444	4544	Unicorn-13974.exe	103
PID 3152 wrote to memory of 3628	3152	Unicorn-12542.exe	104
PID 3152 wrote to memory of 3628	3152	Unicorn-12542.exe	104
PID 3152 wrote to memory of 3628	3152	Unicorn-12542.exe	104
PID 1812 wrote to memory of 3508	1812	Unicorn-1582.exe	105
PID 1812 wrote to memory of 3508	1812	Unicorn-1582.exe	105
PID 1812 wrote to memory of 3508	1812	Unicorn-1582.exe	105
PID 2852 wrote to memory of 4944	2852	Unicorn-33709.exe	106
PID 2852 wrote to memory of 4944	2852	Unicorn-33709.exe	106
PID 2852 wrote to memory of 4944	2852	Unicorn-33709.exe	106
PID 2952 wrote to memory of 588	2952	Unicorn-42837.exe	107
PID 2952 wrote to memory of 588	2952	Unicorn-42837.exe	107
PID 2952 wrote to memory of 588	2952	Unicorn-42837.exe	107
PID 2444 wrote to memory of 3968	2444	Unicorn-31300.exe	108
PID 2444 wrote to memory of 3968	2444	Unicorn-31300.exe	108
PID 2444 wrote to memory of 3968	2444	Unicorn-31300.exe	108
PID 4884 wrote to memory of 3612	4884	Unicorn-37623.exe	109
PID 4884 wrote to memory of 3612	4884	Unicorn-37623.exe	109
PID 4884 wrote to memory of 3612	4884	Unicorn-37623.exe	109
PID 2540 wrote to memory of 5084	2540	Unicorn-28700.exe	110

C:\Users\Admin\AppData\Local\Temp\31ab7acae065351959893cf0282095629beaa27457d938f2ff7d4674f7323c66N.exe
"C:\Users\Admin\AppData\Local\Temp\31ab7acae065351959893cf0282095629beaa27457d938f2ff7d4674f7323c66N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13974.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13974.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10326.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4950.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14566.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34476.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11227.exe
        8⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54388.exe
        9⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25380.exe
        10⤵
        
        PID:8532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37914.exe
        10⤵
        
        PID:12576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13903.exe
        10⤵
        
        PID:16600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38762.exe
        9⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16393.exe
        9⤵
        
        PID:12172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11600.exe
        9⤵
        
        PID:16552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24537.exe
        8⤵
        
        PID:8228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8698.exe
        8⤵
        
        PID:12520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11103.exe
        8⤵
        
        PID:16984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7121.exe
        7⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25468.exe
        8⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        9⤵
        
        PID:17612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37722.exe
        8⤵
        
        PID:12100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5735.exe
        8⤵
        
        PID:16800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50195.exe
        7⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13593.exe
        7⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19949.exe
        7⤵
        
        PID:17660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38154.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35348.exe
        7⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55156.exe
        8⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35660.exe
        9⤵
        
        PID:9532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55468.exe
        10⤵
        
        PID:10448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7656.exe
        10⤵
        
        PID:15992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28978.exe
        9⤵
        
        PID:12184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5735.exe
        9⤵
        
        PID:16632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57314.exe
        8⤵
        
        PID:9936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37753.exe
        8⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27610.exe
        7⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41460.exe
        8⤵
        
        PID:14944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52441.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55979.exe
        7⤵
        
        PID:10836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11103.exe
        7⤵
        
        PID:17028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10489.exe
        6⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33060.exe
        7⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48844.exe
        8⤵
        
        PID:12124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65513.exe
        8⤵
        
        PID:17292
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 17292 -s 436
        9⤵
        Program crash
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17930.exe
        7⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63600.exe
        7⤵
        
        PID:17376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25115.exe
        6⤵
        
        PID:8540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48850.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19949.exe
        6⤵
        
        PID:17364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35733.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42260.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36308.exe
        7⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20180.exe
        8⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42292.exe
        9⤵
        
        PID:8768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32352.exe
        10⤵
        
        PID:15904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37634.exe
        9⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63104.exe
        9⤵
        
        PID:16812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23298.exe
        8⤵
        
        PID:9236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35607.exe
        8⤵
        
        PID:16456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-802.exe
        7⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36452.exe
        8⤵
        
        PID:14188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64561.exe
        8⤵
        
        PID:16820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1481.exe
        7⤵
        
        PID:10928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16888.exe
        7⤵
        
        PID:16244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7506.exe
        6⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54388.exe
        7⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17508.exe
        8⤵
        
        PID:9804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49643.exe
        8⤵
        
        PID:14052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6511.exe
        8⤵
        
        PID:18548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43474.exe
        7⤵
        
        PID:10520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47153.exe
        7⤵
        
        PID:2856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48083.exe
        6⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60948.exe
        7⤵
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28813.exe
        7⤵
        
        PID:15148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19737.exe
        6⤵
        
        PID:11316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12552.exe
        6⤵
        
        PID:17072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12201.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16354.exe
        6⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6931.exe
        7⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        8⤵
        
        PID:17736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53099.exe
        7⤵
        
        PID:10944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13903.exe
        7⤵
        
        PID:16580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12233.exe
        6⤵
        
        PID:9036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30427.exe
        6⤵
        
        PID:13256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11103.exe
        6⤵
        
        PID:17004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8378.exe
        5⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38052.exe
        6⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25956.exe
        7⤵
        
        PID:8468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12938.exe
        7⤵
        
        PID:12540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62720.exe
        7⤵
        
        PID:16288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6578.exe
        6⤵
        
        PID:9416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62610.exe
        6⤵
        
        PID:13676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63050.exe
        5⤵
        
        PID:7184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40484.exe
        6⤵
        
        PID:10464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59265.exe
        6⤵
        
        PID:17168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8347.exe
        5⤵
        
        PID:11944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15484.exe
        5⤵
        
        PID:17148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42453.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30903.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17756.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59852.exe
        7⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64092.exe
        8⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3283.exe
        9⤵
        
        PID:10048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5834.exe
        9⤵
        
        PID:14716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59928.exe
        9⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59234.exe
        8⤵
        
        PID:10856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2560.exe
        8⤵
        
        PID:15860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9737.exe
        7⤵
        
        PID:8772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30427.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2935.exe
        7⤵
        
        PID:16648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31922.exe
        6⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17876.exe
        7⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        8⤵
        
        PID:16024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3514.exe
        7⤵
        
        PID:11516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5735.exe
        7⤵
        
        PID:16640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12233.exe
        6⤵
        
        PID:9000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48268.exe
        7⤵
        
        PID:12156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65129.exe
        7⤵
        
        PID:16392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22258.exe
        6⤵
        
        PID:10840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36484.exe
        6⤵
        
        PID:17668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22970.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27180.exe
        6⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63708.exe
        7⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27492.exe
        8⤵
        
        PID:9560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41652.exe
        9⤵
        
        PID:14612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64561.exe
        9⤵
        
        PID:18452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49259.exe
        8⤵
        
        PID:13852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46088.exe
        8⤵
        
        PID:15976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6394.exe
        7⤵
        
        PID:11424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27055.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58363.exe
        6⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32908.exe
        7⤵
        
        PID:14748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52441.exe
        7⤵
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48387.exe
        6⤵
        
        PID:12688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2935.exe
        6⤵
        
        PID:16496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10297.exe
        5⤵
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38732.exe
        6⤵
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5456.exe
        7⤵
        
        PID:16264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52323.exe
        6⤵
        
        PID:9872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36789.exe
        6⤵
        
        PID:16120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18561.exe
        5⤵
        
        PID:9512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43658.exe
        5⤵
        
        PID:13844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4241.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:18584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49469.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-651.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52068.exe
        6⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54388.exe
        7⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42292.exe
        8⤵
        
        PID:8884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37634.exe
        8⤵
        
        PID:10820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54936.exe
        8⤵
        
        PID:17524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14746.exe
        7⤵
        
        PID:9364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46186.exe
        8⤵
        
        PID:17532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35607.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36162.exe
        6⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47143.exe
        7⤵
        
        PID:17700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33577.exe
        6⤵
        
        PID:11256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41393.exe
        6⤵
        
        PID:16256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22986.exe
        5⤵
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16724.exe
        6⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11363.exe
        7⤵
        
        PID:11024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2087.exe
        7⤵
        
        PID:15852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20994.exe
        6⤵
        
        PID:10956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53680.exe
        6⤵
        
        PID:15868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58467.exe
        5⤵
        
        PID:9764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11377.exe
        5⤵
        
        PID:14216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21952.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-194.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11419.exe
        5⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54388.exe
        6⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24524.exe
        7⤵
        
        PID:9960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48875.exe
        7⤵
        
        PID:14380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21608.exe
        7⤵
        
        PID:17268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34730.exe
        6⤵
        
        PID:10432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14480.exe
        6⤵
        
        PID:1244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24537.exe
        5⤵
        
        PID:8236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16866.exe
        5⤵
        
        PID:12500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2935.exe
        5⤵
        
        PID:16488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36033.exe
      4⤵
      PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20860.exe
        5⤵
        
        PID:6584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18468.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21786.exe
        6⤵
        
        PID:14088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41480.exe
        6⤵
        
        PID:1304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49059.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6504.exe
        5⤵
        
        PID:14320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1219.exe
      4⤵
      PID:8580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15595.exe
        5⤵
        
        PID:12280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-168.exe
        5⤵
        
        PID:16992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60817.exe
      4⤵
      PID:3124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22240.exe
      4⤵
      PID:15224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55998.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55998.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54151.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55791.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18332.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27180.exe
        7⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54388.exe
        8⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3179.exe
        9⤵
        
        PID:9504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49259.exe
        9⤵
        
        PID:13868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13327.exe
        9⤵
        
        PID:1272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2058.exe
        8⤵
        
        PID:10296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26585.exe
        8⤵
        
        PID:14852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6504.exe
        8⤵
        
        PID:15228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51923.exe
        7⤵
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34036.exe
        8⤵
        
        PID:9776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-442.exe
        8⤵
        
        PID:14000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62257.exe
        8⤵
        
        PID:19352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
        7⤵
        
        PID:10416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38488.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16930.exe
        6⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16724.exe
        7⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57588.exe
        8⤵
        
        PID:11848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32840.exe
        8⤵
        
        PID:17076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10329.exe
        7⤵
        
        PID:15184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58961.exe
        7⤵
        
        PID:18692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2913.exe
        6⤵
        
        PID:8592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57515.exe
        6⤵
        
        PID:12608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11103.exe
        6⤵
        
        PID:17012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39114.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27180.exe
        6⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31228.exe
        7⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24524.exe
        8⤵
        
        PID:9940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48875.exe
        8⤵
        
        PID:13724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-639.exe
        8⤵
        
        PID:15300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8306.exe
        7⤵
        
        PID:8564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59642.exe
        7⤵
        
        PID:14820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6504.exe
        7⤵
        
        PID:5032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11850.exe
        6⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57588.exe
        7⤵
        
        PID:12008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57537.exe
        7⤵
        
        PID:16544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15713.exe
        6⤵
        
        PID:10972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4776.exe
        6⤵
        
        PID:17904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45658.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33636.exe
        6⤵
        
        PID:7840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45315.exe
        6⤵
        
        PID:11452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13327.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1762.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29930.exe
        6⤵
        
        PID:17400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13593.exe
        5⤵
        
        PID:12016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23213.exe
        5⤵
        
        PID:3840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35733.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27372.exe
        6⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62068.exe
        7⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10771.exe
        8⤵
        
        PID:9388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        9⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24562.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6511.exe
        8⤵
        
        PID:18528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6194.exe
        7⤵
        
        PID:8412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6696.exe
        7⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25860.exe
        7⤵
        
        PID:7032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56531.exe
        6⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32204.exe
        7⤵
        
        PID:8760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2658.exe
        7⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12759.exe
        7⤵
        
        PID:16744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18393.exe
        6⤵
        
        PID:10016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63568.exe
        6⤵
        
        PID:13224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9325.exe
        6⤵
        
        PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62291.exe
        5⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20860.exe
        6⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48844.exe
        7⤵
        
        PID:12064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16120.exe
        7⤵
        
        PID:13420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10617.exe
        6⤵
        
        PID:11932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27745.exe
        6⤵
        
        PID:16760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9354.exe
        5⤵
        
        PID:8604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63178.exe
        5⤵
        
        PID:11864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60105.exe
        5⤵
        
        PID:16964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12009.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19780.exe
        5⤵
        
        PID:1088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54388.exe
        6⤵
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25100.exe
        7⤵
        
        PID:10088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48875.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12759.exe
        7⤵
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59234.exe
        6⤵
        
        PID:10864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52830.exe
        6⤵
        
        PID:15940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26842.exe
        5⤵
        
        PID:7308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38320.exe
        6⤵
        
        PID:16332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26177.exe
        5⤵
        
        PID:11056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53022.exe
        5⤵
        
        PID:15916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26915.exe
      4⤵
      PID:5252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55156.exe
        5⤵
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24524.exe
        6⤵
        
        PID:10040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48875.exe
        6⤵
        
        PID:14388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16975.exe
        6⤵
        
        PID:3136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10610.exe
        5⤵
        
        PID:10468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        5⤵
        
        PID:15232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18624.exe
        5⤵
        
        PID:16408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
      4⤵
      PID:6820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57012.exe
        5⤵
        
        PID:11892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16120.exe
        5⤵
        
        PID:3908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47682.exe
      4⤵
      PID:10912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49786.exe
      4⤵
      PID:16316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31300.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31300.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31095.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58020.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27180.exe
        6⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55156.exe
        7⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60548.exe
        8⤵
        
        PID:9472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49259.exe
        8⤵
        
        PID:13860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25860.exe
        8⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2058.exe
        7⤵
        
        PID:10304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10633.exe
        7⤵
        
        PID:15032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47153.exe
        7⤵
        
        PID:2948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27610.exe
        6⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57580.exe
        7⤵
        
        PID:9880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-442.exe
        7⤵
        
        PID:13948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6511.exe
        7⤵
        
        PID:19360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15793.exe
        6⤵
        
        PID:10288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61562.exe
        7⤵
        
        PID:18340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38488.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54315.exe
        5⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16724.exe
        6⤵
        
        PID:7940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41460.exe
        7⤵
        
        PID:15216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56392.exe
        7⤵
        
        PID:18156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9570.exe
        6⤵
        
        PID:9712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13327.exe
        6⤵
        
        PID:16704
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16704 -s 436
        7⤵
        Program crash
        
        PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60282.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33587.exe
        5⤵
        
        PID:12708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10911.exe
        5⤵
        
        PID:16856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46131.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16354.exe
        5⤵
        
        PID:6560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7595.exe
        6⤵
        
        PID:7296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22146.exe
        7⤵
        
        PID:17260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-634.exe
        6⤵
        
        PID:11332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12759.exe
        6⤵
        
        PID:18440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59322.exe
        5⤵
        
        PID:8960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22258.exe
        5⤵
        
        PID:2512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27055.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36722.exe
      4⤵
      PID:5212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48732.exe
        5⤵
        
        PID:9152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13409.exe
        5⤵
        
        PID:12684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18624.exe
        5⤵
        
        PID:4652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58275.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11377.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58961.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55526.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55526.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34476.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43900.exe
        5⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31228.exe
        6⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42292.exe
        7⤵
        
        PID:8816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37634.exe
        7⤵
        
        PID:12404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40904.exe
        7⤵
        
        PID:15268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61834.exe
        6⤵
        
        PID:11120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30744.exe
        6⤵
        
        PID:15260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3711.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3682.exe
        5⤵
        
        PID:8056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48652.exe
        6⤵
        
        PID:12776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24672.exe
        6⤵
        
        PID:16420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15713.exe
        5⤵
        
        PID:10960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61953.exe
        5⤵
        
        PID:17420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5306.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5306.exe
      4⤵
      PID:6964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42292.exe
        5⤵
        
        PID:8844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37634.exe
        5⤵
        
        PID:12256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38408.exe
        5⤵
        
        PID:16560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
      4⤵
      PID:9360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30777.exe
      4⤵
      PID:15244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8087.exe
      4⤵
      PID:17460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57066.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57066.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22409.exe
      4⤵
      PID:6576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42292.exe
        5⤵
        
        PID:8832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37634.exe
        5⤵
        
        PID:6244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29855.exe
        5⤵
        
        PID:16340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34347.exe
      4⤵
      PID:9372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59810.exe
      4⤵
      PID:14360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52713.exe
      4⤵
      PID:18472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9026.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9026.exe
    3⤵
    PID:548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64684.exe
      4⤵
      PID:7688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14169.exe
        5⤵
        
        PID:17240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47427.exe
      4⤵
      PID:12452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13711.exe
      4⤵
      PID:16748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56860.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56860.exe
    3⤵
    PID:8720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
      4⤵
      PID:4036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58321.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58321.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:13068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11192.exe
    3⤵
    PID:16956
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42837.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42837.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1582.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1582.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12542.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62807.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31404.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6235.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8451.exe
        8⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38732.exe
        9⤵
        
        PID:7500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-323.exe
        10⤵
        
        PID:12336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65513.exe
        10⤵
        
        PID:16732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25609.exe
        9⤵
        
        PID:10512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19768.exe
        9⤵
        
        PID:16624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11186.exe
        8⤵
        
        PID:8344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21186.exe
        9⤵
        
        PID:17336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58195.exe
        8⤵
        
        PID:13576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27055.exe
        8⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-402.exe
        7⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20860.exe
        8⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57588.exe
        9⤵
        
        PID:12228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49369.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:17816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41946.exe
        8⤵
        
        PID:10792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19768.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3289.exe
        7⤵
        
        PID:9644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39280.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43274.exe
        7⤵
        
        PID:13584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10489.exe
        7⤵
        
        PID:18500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35954.exe
        6⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32956.exe
        7⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5763.exe
        8⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25218.exe
        9⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36098.exe
        9⤵
        
        PID:14452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6578.exe
        8⤵
        
        PID:9524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62610.exe
        8⤵
        
        PID:14028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25860.exe
        8⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42218.exe
        7⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57707.exe
        7⤵
        
        PID:12468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11103.exe
        7⤵
        
        PID:17036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63338.exe
        6⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38732.exe
        7⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52323.exe
        7⤵
        
        PID:9892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3047.exe
        7⤵
        
        PID:16108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30787.exe
        6⤵
        
        PID:8352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32994.exe
        6⤵
        
        PID:13600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4241.exe
        6⤵
        
        PID:18568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60739.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14403.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50252.exe
        7⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55156.exe
        8⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24524.exe
        9⤵
        
        PID:10000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49643.exe
        9⤵
        
        PID:14060
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14060 -s 444
        10⤵
        Program crash
        
        PID:14804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6511.exe
        9⤵
        
        PID:18596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56651.exe
        8⤵
        
        PID:10804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47345.exe
        8⤵
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2914.exe
        7⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48652.exe
        8⤵
        
        PID:10832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-168.exe
        8⤵
        
        PID:17044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8314.exe
        7⤵
        
        PID:11960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11103.exe
        7⤵
        
        PID:16976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22986.exe
        6⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16532.exe
        7⤵
        
        PID:8028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32700.exe
        8⤵
        
        PID:11840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25549.exe
        8⤵
        
        PID:17344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1978.exe
        7⤵
        
        PID:10500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7271.exe
        7⤵
        
        PID:17796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58467.exe
        6⤵
        
        PID:9756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        7⤵
        
        PID:18916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11377.exe
        6⤵
        
        PID:14236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58961.exe
        6⤵
        
        PID:16780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49690.exe
        5⤵
        Executes dropped EXE
        
        PID:2028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41124.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61892.exe
        7⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57588.exe
        8⤵
        
        PID:12140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56392.exe
        8⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58003.exe
        7⤵
        
        PID:12356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52136.exe
        7⤵
        
        PID:16928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44810.exe
        6⤵
        
        PID:11168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46842.exe
        7⤵
        
        PID:17180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47032.exe
        6⤵
        
        PID:1124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26391.exe
        6⤵
        
        PID:5992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18082.exe
        5⤵
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20860.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62794.exe
        7⤵
        
        PID:17208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28586.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62040.exe
        6⤵
        
        PID:15952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16537.exe
        5⤵
        
        PID:8088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31546.exe
        5⤵
        
        PID:12424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37015.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33621.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30252.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55628.exe
        6⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32956.exe
        7⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33060.exe
        8⤵
        
        PID:7880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30588.exe
        9⤵
        
        PID:11820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24672.exe
        9⤵
        
        PID:16444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10329.exe
        8⤵
        
        PID:15316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58961.exe
        8⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5514.exe
        7⤵
        
        PID:8512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19553.exe
        7⤵
        
        PID:12728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60801.exe
        7⤵
        
        PID:16784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22986.exe
        6⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42292.exe
        7⤵
        
        PID:8820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12938.exe
        7⤵
        
        PID:12552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42549.exe
        7⤵
        
        PID:13532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44242.exe
        6⤵
        
        PID:9836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        7⤵
        
        PID:17696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20042.exe
        6⤵
        
        PID:13992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3711.exe
        6⤵
        
        PID:18640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52291.exe
        5⤵
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8643.exe
        6⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16724.exe
        7⤵
        
        PID:7948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58963.exe
        7⤵
        
        PID:13464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63376.exe
        7⤵
        
        PID:2828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5514.exe
        6⤵
        
        PID:8500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27721.exe
        6⤵
        
        PID:12764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11600.exe
        6⤵
        
        PID:16916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37490.exe
        5⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33060.exe
        6⤵
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48844.exe
        7⤵
        
        PID:12112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8144.exe
        7⤵
        
        PID:16844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20034.exe
        6⤵
        
        PID:9308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31887.exe
        6⤵
        
        PID:17644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33283.exe
        5⤵
        
        PID:8740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50780.exe
        6⤵
        
        PID:13032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37744.exe
        6⤵
        
        PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13593.exe
        5⤵
        
        PID:13292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60105.exe
        5⤵
        
        PID:16684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7785.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-371.exe
        5⤵
        
        PID:2440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16620.exe
        6⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23060.exe
        7⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11067.exe
        8⤵
        
        PID:10168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48875.exe
        8⤵
        
        PID:12800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12759.exe
        8⤵
        
        PID:19284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47715.exe
        7⤵
        
        PID:11076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24878.exe
        7⤵
        
        PID:15228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25860.exe
        7⤵
        
        PID:7024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26650.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50780.exe
        7⤵
        
        PID:14328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54081.exe
        7⤵
        
        PID:15632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50874.exe
        6⤵
        
        PID:11136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25249.exe
        6⤵
        
        PID:16144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31922.exe
        5⤵
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39308.exe
        6⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56436.exe
        7⤵
        
        PID:12260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-168.exe
        7⤵
        
        PID:16672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59818.exe
        6⤵
        
        PID:11996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11600.exe
        6⤵
        
        PID:16864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60370.exe
        5⤵
        
        PID:7452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49338.exe
        6⤵
        
        PID:2620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57323.exe
        5⤵
        
        PID:12216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36484.exe
        5⤵
        
        PID:17132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57475.exe
      4⤵
      PID:1444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49676.exe
        5⤵
        
        PID:5868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20860.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        7⤵
        
        PID:17992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41946.exe
        6⤵
        
        PID:10696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11600.exe
        6⤵
        
        PID:16524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5602.exe
        5⤵
        
        PID:7284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59050.exe
        5⤵
        
        PID:10612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19768.exe
        5⤵
        
        PID:16476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2017.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20860.exe
        5⤵
        
        PID:1004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45572.exe
        6⤵
        
        PID:11228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27360.exe
        6⤵
        
        PID:13648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53283.exe
        5⤵
        
        PID:11020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52248.exe
        5⤵
        
        PID:16208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2.exe
      4⤵
      PID:7140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38320.exe
        5⤵
        
        PID:16304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40444.exe
      4⤵
      PID:11868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15484.exe
      4⤵
      PID:17112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37535.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8243.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56780.exe
        6⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10179.exe
        7⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20860.exe
        8⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16858.exe
        9⤵
        
        PID:900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2449.exe
        8⤵
        
        PID:11976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3432.exe
        8⤵
        
        PID:16716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44810.exe
        7⤵
        
        PID:11160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47143.exe
        8⤵
        
        PID:17708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65185.exe
        7⤵
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26391.exe
        7⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17122.exe
        6⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42292.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17812.exe
        8⤵
        
        PID:13732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62441.exe
        8⤵
        
        PID:15876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12938.exe
        7⤵
        
        PID:12568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5735.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26561.exe
        6⤵
        
        PID:9920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20042.exe
        6⤵
        
        PID:13968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3711.exe
        6⤵
        
        PID:18664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12410.exe
        5⤵
        
        PID:2652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25586.exe
        6⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58716.exe
        7⤵
        
        PID:7648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41460.exe
        8⤵
        
        PID:14936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28813.exe
        8⤵
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42242.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13903.exe
        7⤵
        
        PID:16588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28953.exe
        6⤵
        
        PID:9096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        7⤵
        
        PID:17744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22258.exe
        6⤵
        
        PID:10680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30319.exe
        6⤵
        
        PID:4248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30857.exe
        5⤵
        
        PID:6380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8939.exe
        6⤵
        
        PID:8024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13130.exe
        7⤵
        
        PID:10932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5351.exe
        7⤵
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60307.exe
        6⤵
        
        PID:11464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29855.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-994.exe
        5⤵
        
        PID:9208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2201.exe
        6⤵
        
        PID:5816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13593.exe
        5⤵
        
        PID:11808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20992.exe
        5⤵
        
        PID:17464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36426.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49188.exe
        5⤵
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3931.exe
        6⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49588.exe
        7⤵
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3898.exe
        7⤵
        
        PID:12200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13903.exe
        7⤵
        
        PID:18188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30594.exe
        6⤵
        
        PID:8224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16393.exe
        6⤵
        
        PID:12152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19576.exe
        6⤵
        
        PID:16836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17122.exe
        5⤵
        
        PID:6372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48732.exe
        6⤵
        
        PID:9144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13409.exe
        6⤵
        
        PID:11828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12376.exe
        6⤵
        
        PID:19400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28867.exe
        5⤵
        
        PID:10588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25513.exe
        5⤵
        
        PID:15336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49248.exe
        5⤵
        
        PID:16132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26721.exe
      4⤵
      PID:2064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42468.exe
        5⤵
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-387.exe
        6⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40484.exe
        7⤵
        
        PID:11072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
        7⤵
        
        PID:16696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20034.exe
        6⤵
        
        PID:9336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56664.exe
        6⤵
        
        PID:17272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38378.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51650.exe
        5⤵
        
        PID:12560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60801.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36723.exe
      4⤵
      PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33060.exe
        5⤵
        
        PID:7872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51559.exe
        6⤵
        
        PID:15784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10329.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63177.exe
        5⤵
        
        PID:5532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16449.exe
      4⤵
      PID:8548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-218.exe
      4⤵
      PID:12740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11441.exe
      4⤵
      PID:17444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22852.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22852.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65228.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41788.exe
        5⤵
        
        PID:436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10563.exe
        6⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16532.exe
        7⤵
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47116.exe
        8⤵
        
        PID:11716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16120.exe
        8⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26482.exe
        7⤵
        
        PID:10364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23415.exe
        7⤵
        
        PID:18908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52602.exe
        6⤵
        
        PID:9744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20042.exe
        6⤵
        
        PID:14008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3711.exe
        6⤵
        
        PID:18708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33074.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16724.exe
        6⤵
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30728.exe
        7⤵
        
        PID:16280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42434.exe
        6⤵
        
        PID:9956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13327.exe
        6⤵
        
        PID:1480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58467.exe
        5⤵
        
        PID:9728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11377.exe
        5⤵
        
        PID:14224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58961.exe
        5⤵
        
        PID:16948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5586.exe
      4⤵
      PID:2520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32218.exe
        5⤵
        
        PID:7112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26060.exe
        6⤵
        
        PID:8976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48875.exe
        6⤵
        
        PID:13520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41480.exe
        6⤵
        
        PID:1208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30977.exe
        5⤵
        
        PID:9844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41963.exe
        5⤵
        
        PID:14464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37056.exe
        5⤵
        
        PID:17604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62378.exe
      4⤵
      PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33060.exe
        5⤵
        
        PID:7792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11555.exe
        6⤵
        
        PID:10988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10447.exe
        6⤵
        
        PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20418.exe
        5⤵
        
        PID:10896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21391.exe
        5⤵
        
        PID:16012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33283.exe
      4⤵
      PID:8460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56193.exe
        5⤵
        
        PID:16004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17042.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4241.exe
      4⤵
      PID:19432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7978.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7978.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24300.exe
      4⤵
      PID:3000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25586.exe
        5⤵
        
        PID:4668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34316.exe
        6⤵
        
        PID:8220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12515.exe
        7⤵
        
        PID:8788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28429.exe
        7⤵
        
        PID:10448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28660.exe
        7⤵
        
        PID:7132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1594.exe
        6⤵
        
        PID:9412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7271.exe
        6⤵
        
        PID:17788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20505.exe
        5⤵
        
        PID:8988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24834.exe
        6⤵
        
        PID:4104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22919.exe
        5⤵
        
        PID:13716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9325.exe
        5⤵
        
        PID:5900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17122.exe
      4⤵
      PID:6316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16724.exe
        5⤵
        
        PID:7932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57012.exe
        6⤵
        
        PID:10968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48985.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10329.exe
        5⤵
        
        PID:15192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58961.exe
        5⤵
        
        PID:17104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19249.exe
      4⤵
      PID:8480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65284.exe
        5⤵
        
        PID:12296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52441.exe
        5⤵
        
        PID:15180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33577.exe
      4⤵
      PID:13648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59721.exe
      4⤵
      PID:3036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56018.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56018.exe
    3⤵
    PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42468.exe
      4⤵
      PID:5224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20860.exe
        5⤵
        
        PID:6300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5456.exe
        6⤵
        
        PID:16220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12634.exe
        5⤵
        
        PID:10844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46088.exe
        5⤵
        
        PID:15968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62971.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42522.exe
      4⤵
      PID:10852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19192.exe
      4⤵
      PID:4428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11522.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11522.exe
    3⤵
    PID:6336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7699.exe
      4⤵
      PID:8796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14251.exe
        5⤵
        
        PID:11800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43149.exe
        5⤵
        
        PID:16912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10826.exe
      4⤵
      PID:13240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5735.exe
      4⤵
      PID:16792
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16792 -s 440
        5⤵
        Program crash
        
        PID:7460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24291.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24291.exe
    3⤵
    PID:9900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
      4⤵
      PID:17388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55913.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55913.exe
    3⤵
    PID:14020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49728.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49728.exe
    3⤵
    PID:16940
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28700.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28700.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37623.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37623.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31095.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7475.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8155.exe
        6⤵
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1274.exe
        7⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52764.exe
        8⤵
        
        PID:8984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37634.exe
        8⤵
        
        PID:12588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5735.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38954.exe
        7⤵
        
        PID:9704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41963.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37056.exe
        7⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31258.exe
        6⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7699.exe
        7⤵
        
        PID:9120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13409.exe
        7⤵
        
        PID:12720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18624.exe
        7⤵
        
        PID:17128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18393.exe
        6⤵
        
        PID:10008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2938.exe
        6⤵
        
        PID:13780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40408.exe
        6⤵
        
        PID:14256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31242.exe
        5⤵
        
        PID:3432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34876.exe
        6⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39308.exe
        7⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
        8⤵
        
        PID:14036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58313.exe
        8⤵
        
        PID:18540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50114.exe
        7⤵
        
        PID:9648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11600.exe
        7⤵
        
        PID:16608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46635.exe
        6⤵
        
        PID:7496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18017.exe
        6⤵
        
        PID:10584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55321.exe
        6⤵
        
        PID:15264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20874.exe
        5⤵
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65068.exe
        6⤵
        
        PID:8808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13706.exe
        6⤵
        
        PID:12320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46000.exe
        6⤵
        
        PID:2584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48458.exe
        5⤵
        
        PID:10032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30777.exe
        5⤵
        
        PID:15264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48247.exe
        5⤵
        
        PID:18512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55259.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50340.exe
        5⤵
        
        PID:3944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4507.exe
        6⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57891.exe
        7⤵
        
        PID:9652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54442.exe
        7⤵
        
        PID:13504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18624.exe
        7⤵
        
        PID:4284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4658.exe
        6⤵
        
        PID:9992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56392.exe
        7⤵
        
        PID:4456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42529.exe
        6⤵
        
        PID:3324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25860.exe
        6⤵
        
        PID:7040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58730.exe
        5⤵
        
        PID:7064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18468.exe
        6⤵
        
        PID:9256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48875.exe
        6⤵
        
        PID:12004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12759.exe
        6⤵
        
        PID:17204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46547.exe
        5⤵
        
        PID:10576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34833.exe
        5⤵
        
        PID:15156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58961.exe
        5⤵
        
        PID:16924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54490.exe
      4⤵
      PID:224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44580.exe
        5⤵
        
        PID:6476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8555.exe
        6⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48844.exe
        7⤵
        
        PID:12076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8144.exe
        7⤵
        
        PID:16772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50795.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7271.exe
        6⤵
        
        PID:17764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54715.exe
        5⤵
        
        PID:8584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62986.exe
        6⤵
        
        PID:17620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58195.exe
        5⤵
        
        PID:13592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3711.exe
        5⤵
        
        PID:18656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50859.exe
      4⤵
      PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7699.exe
        5⤵
        
        PID:8860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        6⤵
        
        PID:17396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10826.exe
        5⤵
        
        PID:13248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-639.exe
        5⤵
        
        PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7425.exe
      4⤵
      PID:9984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        5⤵
        
        PID:17640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43274.exe
      4⤵
      PID:13424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4241.exe
      4⤵
      PID:18560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3061.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3061.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15836.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26988.exe
        5⤵
        
        PID:3884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20844.exe
        6⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20860.exe
        7⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38320.exe
        8⤵
        
        PID:16324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24947.exe
        7⤵
        
        PID:13064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10527.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3489.exe
        6⤵
        
        PID:8612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        7⤵
        
        PID:17380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57235.exe
        6⤵
        
        PID:12736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43200.exe
        6⤵
        
        PID:16088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40386.exe
        5⤵
        
        PID:7160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24524.exe
        6⤵
        
        PID:9968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48875.exe
        6⤵
        
        PID:13564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12759.exe
        6⤵
        
        PID:676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14641.exe
        5⤵
        
        PID:9792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41963.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37056.exe
        5⤵
        
        PID:17944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39986.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54388.exe
        5⤵
        
        PID:6880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3947.exe
        6⤵
        
        PID:9280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1283.exe
        7⤵
        
        PID:13548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23712.exe
        7⤵
        
        PID:16052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37634.exe
        6⤵
        
        PID:12716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-639.exe
        6⤵
        
        PID:15256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50107.exe
        5⤵
        
        PID:9948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36098.exe
        5⤵
        
        PID:14488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25860.exe
        5⤵
        
        PID:7128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8289.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40484.exe
        5⤵
        
        PID:11432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65129.exe
        5⤵
        
        PID:4812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56739.exe
      4⤵
      PID:11132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8223.exe
      4⤵
      PID:16292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28153.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28153.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26988.exe
      4⤵
      PID:64
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53516.exe
        5⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16532.exe
        6⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        7⤵
        
        PID:17356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27913.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19192.exe
        6⤵
        
        PID:16400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46547.exe
        5⤵
        
        PID:8632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        6⤵
        
        PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58195.exe
        5⤵
        
        PID:13568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2551.exe
        5⤵
        
        PID:16204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40386.exe
      4⤵
      PID:7152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42292.exe
        5⤵
        
        PID:8728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37634.exe
        5⤵
        
        PID:12436
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12436 -s 436
        6⤵
        Program crash
        
        PID:14788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5735.exe
        5⤵
        
        PID:16532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
      4⤵
      PID:9380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63568.exe
      4⤵
      PID:13580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9325.exe
      4⤵
      PID:5948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27107.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27107.exe
    3⤵
    PID:5144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55156.exe
      4⤵
      PID:6848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18940.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24562.exe
        5⤵
        
        PID:13748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6511.exe
        5⤵
        
        PID:18624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40594.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59642.exe
      4⤵
      PID:14768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47345.exe
      4⤵
      PID:2912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30761.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30761.exe
    3⤵
    PID:7204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29812.exe
      4⤵
      PID:10668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38512.exe
      4⤵
      PID:16188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22986.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22986.exe
    3⤵
    PID:10660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27290.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27290.exe
    3⤵
    PID:15928
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21021.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21021.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12882.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12882.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16708.exe
      4⤵
      PID:884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16428.exe
        5⤵
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20860.exe
        6⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24524.exe
        7⤵
        
        PID:9976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48875.exe
        7⤵
        
        PID:14420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6511.exe
        7⤵
        
        PID:18520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56651.exe
        6⤵
        
        PID:10812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48414.exe
        6⤵
        
        PID:808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11954.exe
        5⤵
        
        PID:9672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59810.exe
        5⤵
        
        PID:14368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46840.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31922.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20860.exe
        5⤵
        
        PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33115.exe
        5⤵
        
        PID:11312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11103.exe
        5⤵
        
        PID:17020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19337.exe
      4⤵
      PID:7384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        5⤵
        
        PID:2960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23883.exe
      4⤵
      PID:9664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36484.exe
      4⤵
      PID:17320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43826.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43826.exe
    3⤵
    PID:3608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32218.exe
      4⤵
      PID:7104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6385.exe
        5⤵
        
        PID:11236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60298.exe
        6⤵
        
        PID:16240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24849.exe
        5⤵
        
        PID:1380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25860.exe
        5⤵
        
        PID:6988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
      4⤵
      PID:9420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2938.exe
      4⤵
      PID:13840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3711.exe
      4⤵
      PID:18632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43355.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43355.exe
    3⤵
    PID:6096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33060.exe
      4⤵
      PID:7864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        5⤵
        
        PID:17288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10329.exe
      4⤵
      PID:15200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59425.exe
      4⤵
      PID:16096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24617.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24617.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9722.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9722.exe
    3⤵
    PID:10112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60340.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60340.exe
    3⤵
    PID:13456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54495.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54495.exe
    3⤵
    PID:18436
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5636.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5636.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1227.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1227.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18052.exe
      4⤵
      PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4315.exe
        5⤵
        
        PID:6436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9515.exe
        6⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        7⤵
        
        PID:18876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42242.exe
        6⤵
        
        PID:11356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30735.exe
        6⤵
        
        PID:4116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47507.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62633.exe
        6⤵
        
        PID:15900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16393.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49073.exe
        5⤵
        
        PID:2268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50371.exe
      4⤵
      PID:7068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42292.exe
        5⤵
        
        PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37634.exe
        5⤵
        
        PID:12628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38408.exe
        5⤵
        
        PID:17056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36842.exe
      4⤵
      PID:9488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2938.exe
      4⤵
      PID:13820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39749.exe
      4⤵
      PID:1580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49307.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49307.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54388.exe
      4⤵
      PID:7096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19900.exe
        5⤵
        
        PID:8472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22146.exe
        6⤵
        
        PID:18412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37634.exe
        5⤵
        
        PID:12328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39285.exe
        5⤵
        
        PID:17224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6577.exe
      4⤵
      PID:11148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24849.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25860.exe
      4⤵
      PID:5428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49898.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49898.exe
    3⤵
    PID:7288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22420.exe
      4⤵
      PID:12244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27469.exe
      4⤵
      PID:17508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32043.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32043.exe
    3⤵
    PID:11032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8223.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8223.exe
    3⤵
    PID:16232
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16794.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16794.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-947.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-947.exe
    3⤵
    PID:4360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3931.exe
      4⤵
      PID:5896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34124.exe
        5⤵
        
        PID:8792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37634.exe
        5⤵
        
        PID:8660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-639.exe
        5⤵
        
        PID:14064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14833.exe
      4⤵
      PID:10604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42155.exe
      4⤵
      PID:9464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63376.exe
      4⤵
      PID:3080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40386.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40386.exe
    3⤵
    PID:7144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8939.exe
      4⤵
      PID:7856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41460.exe
        5⤵
        
        PID:14976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52441.exe
        5⤵
        
        PID:14060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60307.exe
      4⤵
      PID:11456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46384.exe
      4⤵
      PID:17680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60666.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60666.exe
    3⤵
    PID:9200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22258.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22258.exe
    3⤵
    PID:12180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40408.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40408.exe
    3⤵
    PID:2452
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52796.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52796.exe
  2⤵
  PID:2992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12867.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12867.exe
    3⤵
    PID:7052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42292.exe
      4⤵
      PID:1568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24480.exe
        5⤵
        
        PID:17724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37634.exe
      4⤵
      PID:12348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38408.exe
      4⤵
      PID:16432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-522.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-522.exe
    3⤵
    PID:9544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36484.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36484.exe
    3⤵
    PID:17312
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13025.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13025.exe
  2⤵
  PID:6148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24612.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24612.exe
    3⤵
    PID:9132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
      4⤵
      PID:17632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13409.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13409.exe
    3⤵
    PID:12208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18624.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18624.exe
    3⤵
    PID:2928
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55370.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55370.exe
  2⤵
  PID:10072
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37674.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37674.exe
  2⤵
  PID:12196
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56073.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56073.exe
  2⤵
  PID:1036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 14060 -ip 14060
1⤵
PID:14016

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17096

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10326.exe

Filesize
468KB

MD5
d8d349dba84ce9386b1f5d69a16c1b4d

SHA1
07e6476a882b74e74d2daa46eee37fdacd8513e2

SHA256
04e573fef94e9fe77ad737bdc53816f05f779654d62bca9de38935d87fdba30a

SHA512
1998ecfa29e90abd2f32e4fdda334201e44c55881725b83967ee565a6f879b01bdd58f71ab15ecff95af812c4ce61b092069533a683a49a445cb5751f9371c2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12542.exe

Filesize
468KB

MD5
759834441666c4d1d0df0ba2a28fb83b

SHA1
ae1c312da9ff7f1e4e8bb6307d4c97ee15416276

SHA256
61686f5705f05cd63f3803d92f32147a323f248a855cbdc7b3e743da54d1996e

SHA512
228ae21cc1e47976c06a854706f4bdc26708e3e0d2c1a909f6eeb7e727b9d6356b30cefe1541dae0857ab4c97d796f6198a08dab69e900ee217b3ad3e4936637

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12759.e±e

Filesize
1B

MD5
93b885adfe0da089cdf634904fd59f71

SHA1
5ba93c9db0cff93f52b521d7420e43f6eda2784f

SHA256
6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d

SHA512
b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13974.exe

Filesize
468KB

MD5
29babe9b468be54910ce27a04a5a0468

SHA1
3c45f7f04b0a98570ad872e34ea30161fa55a63c

SHA256
2355810cc2f715c224492032ee9b39cc243cadd1640299f5339a21cf017d7ff8

SHA512
94902273d7927015b881a74d8b150cd975d749e1f750ca03401aec73be148ce7fbb67ebfcbb719232aa933dbc736bea141ffbb9e253eebe204ab9e3a585ea9f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14566.exe

Filesize
468KB

MD5
d71c832f8d5c783378d0e2de7ae214f5

SHA1
64af7a6e52a36820a92e2501191fd1e33d119a8f

SHA256
7e19b6af385feac4cb821f54f1ec542ff8006540ca1749b1ccb3fcc5f29654d2

SHA512
bc6d50ef9568d0593b50a4c540dbf5fdf23257808b6bdc770f921441b450e6e1abe89ec87eb532ff9f850c00f5ef89fb386248aa6fd0cd7a493d26dd30c97963

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1582.exe

Filesize
468KB

MD5
1ef91f8706f9e8026496ee0c9e440adb

SHA1
d22f0f2b954198a5f6dd448ce87cc7ca3bf67b73

SHA256
70bf721d09d0855e6787b66a12caf7b7820408f5fcafad3fa679c3e097abbb51

SHA512
258b3519ace1f714f8dd1d66445b4c56aaa60263b9c695f04425a3fb9047756d5b3c2fe912de2723f6f20387cf7bf5793bf43d88ee21633d28167b7fadcfc68f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21021.exe

Filesize
468KB

MD5
f4af0b04db156174f8c95f23f619a23a

SHA1
fed3a64f3b1f591fd4851f61983c1c1e5803bd6e

SHA256
fdbb11c20eb7945a8b1537ebd5d3c951c524a7e7657a9900fb78de6a61141209

SHA512
6cfae914ba7b347b58834199fd9c81196ffe18d359a04188791a17190a6a17b2e5f0c9039fcab6b12d1d68e3142db4b84e9290615f8912c06fb27419e80d5853

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22852.exe

Filesize
468KB

MD5
5b5eb7e8e0530474efd49fd76b141041

SHA1
d1846c72ed8b114b2f22876896914aa8169833e2

SHA256
8520db7514d991475670fb3b77bbab15b01509118ed3944c19a5c95b7d3b6e8b

SHA512
404e32fdc7ff66a7dde279f6575ed333fb1053c3b504b21caef87f54ccb243ce4a9a82b6d11bc0c74ac9dc9e39ce6e88e5becf1d78afab37956e8e6eb71f2045

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25218.exe

Filesize
468KB

MD5
c18696ed49f37398a534494c4f5288d7

SHA1
423416cbc5ffe4590c3f9151994d388075f385fe

SHA256
2d53746892c374c8b94f53669692c6b5dc3e4f134d1966a741b5bf2f0adb11bb

SHA512
d85d0e9c706947deacd8af729eab5cbac591a211bfc8b9ad77055d9f2cf04ad7ee012dafd969e5f05e0d51648a53dd853af6ca5802ccb4e5196feeb09904c3a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26842.exe

Filesize
468KB

MD5
5988d99df6541331b59ccc5efa4b4e20

SHA1
8962ce5ac76b6d48503c3dc2cfc5e3468e58e9d7

SHA256
b791c5cb8690af6eeb45aa4f67392ffdeac4e3818c579d35286dbfb0007f8d68

SHA512
6188c136cb991821396dca700c9bfcb4b5ee30e60b4b224178370f9747679f9bd5d50994acf8fd39017797ecbeefe735d3ebd7f9a0c9b5ed6912089496088203

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28700.exe

Filesize
468KB

MD5
7b8d178a02eada61ff47609d911e5689

SHA1
2c9d5b64e1b9cf588612aa0cfaad9ac8670927e4

SHA256
ada66d6d52e0d6a08ae65da71b8cc41869ba168a2f9c18dd277690f90c273989

SHA512
b41c0147991b12623c3edcf088826a00542d9c8aa154628b3e8101e5e7bfe53f7c23676367bce31ffaaaa3997441483b5177b2ea74c95eb416c102af763e816b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30252.exe

Filesize
468KB

MD5
eaa300aafbe81835396afc63f27c08c6

SHA1
65caf3118f1eea49427860a47ed53bfd7286c7d2

SHA256
129fdf09bb7e62075ec1ef2074612a3c6ddaf2e79925629d2ff0549697915b1f

SHA512
652ec11e7daa59c04f265f8ad7ae83cf1270e0e3b9ec33b7262cde1e3c844bb03481884da4d468ae4cd868a119b8d037fc1a8b020d89e89b847fbfc4370165d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3061.exe

Filesize
468KB

MD5
d20446d0f119ce0a18fb7ce683e89b6f

SHA1
cda33fc71e9841c2bb3d4488352002a09479db6a

SHA256
60d214f70c7b376f7732c636932f769fb76636271ab394499200def57e6bb033

SHA512
741cd2ac3f7f303cb8430b3dbb1c62665adb424f7ec68c65381f68e4d0f9e63524a743165a80023bc3bbfb74571b744fc31b68cb35c78cebfe62fd2a4d46d535

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30903.exe

Filesize
468KB

MD5
8c0703fa8904284c3175d8bc5d3c732d

SHA1
8dc8dfea1463f906b7669bb53887b693213cd54f

SHA256
228ea618a887f195c1207aeb5dfa1fd4e6ffd18701ec6b9c5f8854856622c233

SHA512
de3bff6a50aaa44841c79e32a593cccd79f4fc6b018dd75b70c3072e1739f17de1b155c622f812ab8759bb83e86eae6c5cfccab1181f5444134ef179a0fa337b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31095.exe

Filesize
468KB

MD5
c97dd4582e2d1b5b4bcdff81b32dcc86

SHA1
dca5f6fa826a7558b408c2df8bc394c48dc6ea93

SHA256
32969366dda37a01762ce65db7e6cece2677e412f70285d9819bbac2181b599d

SHA512
5197cb70b3726a05d07fee88613f59b15e9ce0274932f95a7e8c21b33b3ccf29b4556b195a49a7136f7e9d2c0bf473b91cefee835b2014317f0dfb70fa95f55d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31300.exe

Filesize
468KB

MD5
a8495e827ba625f8a97ac01d0bda53d2

SHA1
9fa4c70badffca51c7ae966dc545258086b0abed

SHA256
4d948683a363d94e1c4dee507e15ae5475fd14b7d6be992baaabb3b0492487b0

SHA512
4e3bb82bfd549680320bbc337a8fa684c19b318c371aed901094b9d9fa4d6120322890b3bd514ccc71b265a3ffb4ebd798794d4857799727ca9553b8c642ab39

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31404.exe

Filesize
468KB

MD5
146b13a62b8f4a291282e952cfb935be

SHA1
28d7220ba0ae29a76ad840db24e148d5eb3ab805

SHA256
f17c4bcf6492dccbed86fcbf46429cd9f8f38d583b7ac4363a5f52a26cef9b17

SHA512
cfaa6417533deae264b6ae31da2c188a402ddec06528f875502c66417b310e2dde1651a047314c5823062f0d03c11086f2233e3db70a65188794c2074a5261a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33621.exe

Filesize
468KB

MD5
e20947a31c051ff32df23aac7ef834b7

SHA1
7d6243899897b799f1697fa8e0fba62f8fe80752

SHA256
774f233d978522edcbe49972fa6e384b56be42129e05fc93f7b5a7315e71b6f2

SHA512
25ff3d939dfb9baa11fcbe444deead2c5ff0d7fbcc68152ce2e497459ad4026c91d52f5218d1cc8afda22c3e311b90ae598cc56040dc4613b6b7a76b93db60c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe

Filesize
468KB

MD5
6d587cd493ae2501a74628db844443d0

SHA1
e518c4a82721bb7e4b5a8adb98c5aca843f18e03

SHA256
4967b2bb9c03e5fbed890ed9840489b88520587bf31560c275697763d36702c0

SHA512
93d00fc208550bd3b1c18619e399e8c873b92ec67f2064b3a159b1f14d227f7ce5e8d805c89ba856ee003e57a30478dc11fff8e8c4101228f145d711fc1b8c04

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35733.exe

Filesize
468KB

MD5
07de1797d07a8725376d14de08e517ae

SHA1
4f20edbcbaeaee2ea86a12c12fa04793928e6c86

SHA256
ee4a3e1cdb204afe1f9daeca1410d9c5c74dddb0337fafee04d3dcd7ea0da683

SHA512
e840e5361c9be8ae3142a16660ca5e915db470a81a3957ce04ffcc033f6d7525e90d8e2b67b144289fff78b100f6bc0c38b5af3e034eb09980e2c1478a742ad3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37535.exe

Filesize
468KB

MD5
48b21a67e80c97dbb61ff9ec785de8e8

SHA1
0bedb59b5b47b2ad098ea3f97ea35d1dfe31e950

SHA256
ce2c5c1ab177070d329acbb050a6e92d6f0543bd68b233cd58a7a2b2dfef3afd

SHA512
80cfcf69f0f090554ea89a0e2fedb896ea06c51dc76f4a7aa3c479a4c22e206e0abfc388c48d010c377a80bfa426ffdf010e87d946304c950926a13a9ddc6516

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37623.exe

Filesize
468KB

MD5
f820ab41bd51d1a61aaf9b0e2a5a78de

SHA1
381c6ff52c483c52686b94d048978384fa7a8ddb

SHA256
98a2f97b57e4daecc84b6426a14df6bd8e4b4bbf1031ed89c0f4a54088012349

SHA512
b48e479b282ddb4551e3cb2707307c8c718bda05d20711b21ccf42a4c13d96ef863d8b5e70684959138ea414eb197d2b15766a7b5f070070722f8694cb811ab0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42453.exe

Filesize
468KB

MD5
6cc40e421a6058361fab9f1794247723

SHA1
b8e903e76c56d04da74367025fe6af25f180cb61

SHA256
6d08ccae2821e2c4cf6848194b6ac0a84ead1f0079b01e4b0b8c4b65bfa2a29e

SHA512
4dac6f71310c5285561dec45e4fb14a6cb94ea38af940b122cafd5cd66bf85ffab512894c173d0736a17566aeae04b267a6f70853818a74a2278965102c695d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42837.exe

Filesize
468KB

MD5
6bfd10adb38996a8159290e863cf64a1

SHA1
952a0e48dd68dfa687f7dfc66c62ad716e4e1327

SHA256
a0d3fc231efbaca669dbb0223804e1ca0709519933f47462c8a4aebe7bb61884

SHA512
dcd1f675491d5b5920db1b99d3490ebc7926b60400a4fdff13c3959b2f7181d083de179eba2b8f9096be72bcdc0ed9d5e5b425fe15459c65247370bae51a9366

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49469.exe

Filesize
468KB

MD5
1487525732ee8ca42a394e3d66b0d74d

SHA1
42a6ca24bd8673fb26f625caf1fa306e2e020702

SHA256
46d8a16d0f17bf7dadab2ec56b9d8f69745f984a3b3a16b7653886783e7af4a8

SHA512
d9151a9c54c1c1859fc7ae40b46f4c93fcfd026b89922e406c6b6042ca898d1f1d712d208d7880c73e1d1c1f3a04c9693c292c780d2bf8b9a36e6e1c816ff822

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4950.exe

Filesize
468KB

MD5
acffb38daa64af7ce9cfcd43ae76ca60

SHA1
227d034dcacadcccc4dff228e828ee7632bc8bad

SHA256
e8ac677f66230662cc31a245e9642693ccc2794981154fde8ade9ecd7e47a26a

SHA512
81f008729733af3c181b76a9f0a2bc071675b1b876cc6a6d413775d98d374bb8cb7aa5db5d65de096113cf837bca7e757866dc732443315a6dee377e46d8dc5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54151.exe

Filesize
468KB

MD5
40e689525c8ef2f333152ec63f992aae

SHA1
3aaa9b514feae10419cc7743b562016a4553d5a5

SHA256
4ea3b6bb97a88535e2a41b197efc86c29fd58d8fd4411e3ad7ed77344531d900

SHA512
3f18aed46b8c2fe3f4cb350346550c04136e75731d8984fab920e91d42a79f7426991ec1ebc6ff4a415bbc0aad5c93348fd59383748804451a71b4256bf195c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55526.exe

Filesize
468KB

MD5
1a6548d07e82aa00cbab72a523a7c30a

SHA1
51cdd85269c9997725e7edc754f3adb53b460a89

SHA256
aac9da0d9611bc0815fb57dce0bace7a5476b2a9265a21f338d03e922461a5e3

SHA512
124f605a3d614c0f75e08cabd27c4855b0efa092fa49ccc07cd3e375a368f98732bcecf5462c7e47467c3518e2ff85fb9e3d45e0d1019149dc167a37da508bea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55791.exe

Filesize
468KB

MD5
37609e6cffd1bc5aa9c0e1761292942c

SHA1
3049450ddd1001aec1c85b54ecade2e1e48f9930

SHA256
31203467ff7132d7be120ff446d6f9abe0634f96fc5d12fa00b13516de05132f

SHA512
7cccb3c90d81e098f7e2d33e5195bffeba51f740e0d285665e58f9b34766e46b002dd97289801b1b069cc797ebeccbb130324c41d62296531556d8649b1a67ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55998.exe

Filesize
468KB

MD5
9068efe3abd70566a78084e1e0cd76d9

SHA1
c74d7ef7f7d351259ddb1706d2c75e9390a227ff

SHA256
b69cddf5c6477988998709ddea6f5eefed5b535bb627d37444361e9476ed0eba

SHA512
44e024e892ac14046d59763edc5517411d6c799401c31207a3b599e565435d21ef6fdcc5efe177e85b8212c403b8e573169a15950f45986686e5bc9fc616f00b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5636.exe

Filesize
468KB

MD5
e34c0f567b4fbb9261faa57feb934a0a

SHA1
e5ef2b68b62ca3ae63dbe348b38e4bb2e80b5251

SHA256
25df64dcf420f300dddb770dfd11264e916a2c81af64e734788627786df67f0a

SHA512
d468cc00d5a7abf3dc76283c721ecb62f20c2ed94184f6a1d5740efd3147e01e2d21b1375df1e79fb4cc2db987ca6746635f37157a37d8eea0098c7f403df5cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60739.exe

Filesize
468KB

MD5
ed6ab8a99f2c8c9ec6249ba1ba7b8b06

SHA1
69b1a0fe82fa29caa27a0f6e2697bb6a45a9000d

SHA256
747cbc5d4f05619e27dd87718c9671ffb9fa38fc381ab81075def19a4d67c4fb

SHA512
d593f3dfd6052e749efe4e87d36e3bff4a4a7bb7df7afab3735a6b633f9b85ff11486180e8360074bbf9dcde351310277cc063cde9d2d6c22e952c17cccec6c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe

Filesize
468KB

MD5
b8b63f3410dfd063720dcb66f7b76d26

SHA1
d74ed480dcd646a91ffdba1ac767d95c508ae476

SHA256
a4a8e3f83b4e7a97630917c564ce8da77b210b09a96828f2dd87f42b94442fc9

SHA512
d3cfc9121baae617d1e46d591fc501b6dc1c9173a5517a487e5e5e4e070e373aea827c36164a981cd318ea1715217481cbb2eb13ef4568413957a8b99b4702f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62807.exe

Filesize
468KB

MD5
990aea4d6a2ca60e0815964b1fcfbd40

SHA1
b57286cd2c869c322ad909090ff25f46d274cc25

SHA256
cc92ab67f93c6ce82a7ee7766cd5ad79e719ab14727de94c4aeed5f1b7d9544f

SHA512
816cf8c9ae96c3860033089a0d70392b570a8194b415cda0c10fd08cb7e80934ce76bc2a74a32f13d694880a8d18a510620cdd97805c96581b3781fab4f73d0f

Download Submit
memory/64-463-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/216-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/224-506-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/244-94-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/436-416-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/588-131-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/848-190-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/868-181-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/884-414-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1088-507-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1104-347-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1108-450-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1284-342-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1356-184-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1392-48-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1444-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1556-346-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1720-526-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1812-28-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1820-95-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1832-162-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1844-272-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1848-163-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1924-244-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1956-350-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2028-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2052-257-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2064-445-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2212-309-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2216-348-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2228-232-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2400-191-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2412-386-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2416-87-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2440-410-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2444-102-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2520-424-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2540-35-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2652-438-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2732-286-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2852-65-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2916-333-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2928-3328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2952-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2984-335-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2992-512-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3000-435-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3004-513-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3060-51-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3088-265-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3104-283-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3152-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3168-374-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3232-344-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3368-101-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3392-334-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3412-375-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3432-451-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3508-118-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3516-237-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3592-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3608-434-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3612-150-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3624-345-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3628-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3748-413-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3864-208-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3920-18-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3944-469-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4060-377-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4184-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4360-470-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4404-444-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4540-252-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4544-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4576-437-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4720-436-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4860-177-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4884-70-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4888-491-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4920-343-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4944-126-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4980-214-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4984-224-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5000-227-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5008-245-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5060-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5084-153-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5096-306-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5100-490-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5128-539-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5144-543-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5188-555-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5196-556-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5228-559-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5280-557-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5288-558-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/7040-3283-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads