715ac5644fb3d5f894c23a74d77e7b65b83d8ced4d08ffa25c729714f81c70fc

Analysis

max time kernel
118s
max time network
63s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 12:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

715ac5644fb3d5f894c23a74d77e7b65b83d8ced4d08ffa25c729714f81c70fcN.exe
Size

184KB
MD5

af03b11bc985c5423fa11b13b2b2dbe0
SHA1

fd14ffbf9784ce998a29c48721fe402358ee5d22
SHA256

715ac5644fb3d5f894c23a74d77e7b65b83d8ced4d08ffa25c729714f81c70fc
SHA512

a641adbcba1b4d3b9b87d2b6536412fe0d3d6cd4a40bda6fd211dc39e0e0c1c323e912cb2bad607c49bb685f72fa25a6bb2c34f03fc2fa696c3ea2c0621f5359
SSDEEP

3072:6/SQlkoAiKx9dtIZwgbo81lzXlvnqnxiuW:6/AoQLtIw8jzXlPqnxiu

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2980	Unicorn-12209.exe
1504	Unicorn-42910.exe
4524	Unicorn-64077.exe
2808	Unicorn-36818.exe
1764	Unicorn-36818.exe
2656	Unicorn-2099.exe
1916	Unicorn-53901.exe
3428	Unicorn-56610.exe
2008	Unicorn-12240.exe
3396	Unicorn-28022.exe
2816	Unicorn-40274.exe
4036	Unicorn-36190.exe
184	Unicorn-60621.exe
2044	Unicorn-41020.exe
4012	Unicorn-54756.exe
3792	Unicorn-25858.exe
4076	Unicorn-55193.exe
3212	Unicorn-55946.exe
1812	Unicorn-51862.exe
2756	Unicorn-19360.exe
3868	Unicorn-29011.exe
3944	Unicorn-47394.exe
3880	Unicorn-64477.exe
2488	Unicorn-2469.exe
2960	Unicorn-2469.exe
4756	Unicorn-2469.exe
3888	Unicorn-56309.exe
4772	Unicorn-46824.exe
4072	Unicorn-49624.exe
1516	Unicorn-55489.exe
4236	Unicorn-9049.exe
3204	Unicorn-62889.exe
1016	Unicorn-58250.exe
1540	Unicorn-43568.exe
4168	Unicorn-50445.exe
4968	Unicorn-50466.exe
2876	Unicorn-14264.exe
2500	Unicorn-13709.exe
4560	Unicorn-43044.exe
2340	Unicorn-5349.exe
2212	Unicorn-58634.exe
1748	Unicorn-56588.exe
2956	Unicorn-41649.exe
1340	Unicorn-45998.exe
2880	Unicorn-9796.exe
1592	Unicorn-54358.exe
3588	Unicorn-39174.exe
3284	Unicorn-47077.exe
3612	Unicorn-2972.exe
4480	Unicorn-35090.exe
4184	Unicorn-52173.exe
3448	Unicorn-14669.exe
388	Unicorn-59786.exe
3036	Unicorn-59786.exe
3096	Unicorn-2417.exe
1168	Unicorn-41020.exe
1740	Unicorn-47150.exe
4500	Unicorn-38220.exe
1348	Unicorn-21684.exe
4008	Unicorn-27284.exe
4836	Unicorn-16515.exe
4872	Unicorn-27306.exe
5112	Unicorn-15608.exe
2232	Unicorn-56086.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
8632	5748	WerFault.exe	225
2120	17404	WerFault.exe	866

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22961.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11841.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61405.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13808.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63667.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60568.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6340.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5993.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21120.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28888.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13808.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14244.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64477.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58634.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5012.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15094.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38505.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23838.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26552.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5012.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37623.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61911.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45557.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23539.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40808.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6219.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64860.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14545.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59152.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26658.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64151.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64320.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1226.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41876.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4159.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48209.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58858.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5798.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50305.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22528.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26252.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1468.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26010.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15240.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34140.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51577.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14244.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18166.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12848.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55489.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13092.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2257.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55193.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33583.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43134.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45088.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26377.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12692.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19863.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	12676	dwm.exe
Token: SeChangeNotifyPrivilege	12676	dwm.exe
Token: 33	12676	dwm.exe
Token: SeIncBasePriorityPrivilege	12676	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2800	715ac5644fb3d5f894c23a74d77e7b65b83d8ced4d08ffa25c729714f81c70fcN.exe
2980	Unicorn-12209.exe
1504	Unicorn-42910.exe
4524	Unicorn-64077.exe
2808	Unicorn-36818.exe
2656	Unicorn-2099.exe
1764	Unicorn-36818.exe
1916	Unicorn-53901.exe
3428	Unicorn-56610.exe
2008	Unicorn-12240.exe
3396	Unicorn-28022.exe
2816	Unicorn-40274.exe
2044	Unicorn-41020.exe
4036	Unicorn-36190.exe
4012	Unicorn-54756.exe
184	Unicorn-60621.exe
3792	Unicorn-25858.exe
4076	Unicorn-55193.exe
3212	Unicorn-55946.exe
3944	Unicorn-47394.exe
3868	Unicorn-29011.exe
2756	Unicorn-19360.exe
1812	Unicorn-51862.exe
4072	Unicorn-49624.exe
2488	Unicorn-2469.exe
4772	Unicorn-46824.exe
2960	Unicorn-2469.exe
3880	Unicorn-64477.exe
4756	Unicorn-2469.exe
1516	Unicorn-55489.exe
3888	Unicorn-56309.exe
4236	Unicorn-9049.exe
3204	Unicorn-62889.exe
1016	Unicorn-58250.exe
1540	Unicorn-43568.exe
4168	Unicorn-50445.exe
4968	Unicorn-50466.exe
2876	Unicorn-14264.exe
2500	Unicorn-13709.exe
4560	Unicorn-43044.exe
2340	Unicorn-5349.exe
2212	Unicorn-58634.exe
2956	Unicorn-41649.exe
1748	Unicorn-56588.exe
1340	Unicorn-45998.exe
2880	Unicorn-9796.exe
1592	Unicorn-54358.exe
3588	Unicorn-39174.exe
1168	Unicorn-41020.exe
3448	Unicorn-14669.exe
388	Unicorn-59786.exe
4480	Unicorn-35090.exe
3612	Unicorn-2972.exe
3284	Unicorn-47077.exe
4184	Unicorn-52173.exe
3036	Unicorn-59786.exe
3096	Unicorn-2417.exe
1740	Unicorn-47150.exe
4500	Unicorn-38220.exe
4836	Unicorn-16515.exe
4008	Unicorn-27284.exe
1348	Unicorn-21684.exe
4872	Unicorn-27306.exe
516	Unicorn-33235.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 2980	2800	715ac5644fb3d5f894c23a74d77e7b65b83d8ced4d08ffa25c729714f81c70fcN.exe	83
PID 2800 wrote to memory of 2980	2800	715ac5644fb3d5f894c23a74d77e7b65b83d8ced4d08ffa25c729714f81c70fcN.exe	83
PID 2800 wrote to memory of 2980	2800	715ac5644fb3d5f894c23a74d77e7b65b83d8ced4d08ffa25c729714f81c70fcN.exe	83
PID 2980 wrote to memory of 1504	2980	Unicorn-12209.exe	87
PID 2980 wrote to memory of 1504	2980	Unicorn-12209.exe	87
PID 2980 wrote to memory of 1504	2980	Unicorn-12209.exe	87
PID 2800 wrote to memory of 4524	2800	715ac5644fb3d5f894c23a74d77e7b65b83d8ced4d08ffa25c729714f81c70fcN.exe	88
PID 2800 wrote to memory of 4524	2800	715ac5644fb3d5f894c23a74d77e7b65b83d8ced4d08ffa25c729714f81c70fcN.exe	88
PID 2800 wrote to memory of 4524	2800	715ac5644fb3d5f894c23a74d77e7b65b83d8ced4d08ffa25c729714f81c70fcN.exe	88
PID 1504 wrote to memory of 2808	1504	Unicorn-42910.exe	91
PID 1504 wrote to memory of 2808	1504	Unicorn-42910.exe	91
PID 1504 wrote to memory of 2808	1504	Unicorn-42910.exe	91
PID 4524 wrote to memory of 1764	4524	Unicorn-64077.exe	92
PID 4524 wrote to memory of 1764	4524	Unicorn-64077.exe	92
PID 4524 wrote to memory of 1764	4524	Unicorn-64077.exe	92
PID 2980 wrote to memory of 1916	2980	Unicorn-12209.exe	94
PID 2980 wrote to memory of 1916	2980	Unicorn-12209.exe	94
PID 2980 wrote to memory of 1916	2980	Unicorn-12209.exe	94
PID 2800 wrote to memory of 2656	2800	715ac5644fb3d5f894c23a74d77e7b65b83d8ced4d08ffa25c729714f81c70fcN.exe	93
PID 2800 wrote to memory of 2656	2800	715ac5644fb3d5f894c23a74d77e7b65b83d8ced4d08ffa25c729714f81c70fcN.exe	93
PID 2800 wrote to memory of 2656	2800	715ac5644fb3d5f894c23a74d77e7b65b83d8ced4d08ffa25c729714f81c70fcN.exe	93
PID 2808 wrote to memory of 3428	2808	Unicorn-36818.exe	95
PID 2808 wrote to memory of 3428	2808	Unicorn-36818.exe	95
PID 2808 wrote to memory of 3428	2808	Unicorn-36818.exe	95
PID 1504 wrote to memory of 2008	1504	Unicorn-42910.exe	96
PID 1504 wrote to memory of 2008	1504	Unicorn-42910.exe	96
PID 1504 wrote to memory of 2008	1504	Unicorn-42910.exe	96
PID 2656 wrote to memory of 3396	2656	Unicorn-2099.exe	97
PID 2656 wrote to memory of 3396	2656	Unicorn-2099.exe	97
PID 2656 wrote to memory of 3396	2656	Unicorn-2099.exe	97
PID 1764 wrote to memory of 2816	1764	Unicorn-36818.exe	98
PID 1764 wrote to memory of 2816	1764	Unicorn-36818.exe	98
PID 1764 wrote to memory of 2816	1764	Unicorn-36818.exe	98
PID 1916 wrote to memory of 4036	1916	Unicorn-53901.exe	99
PID 1916 wrote to memory of 4036	1916	Unicorn-53901.exe	99
PID 1916 wrote to memory of 4036	1916	Unicorn-53901.exe	99
PID 4524 wrote to memory of 2044	4524	Unicorn-64077.exe	101
PID 4524 wrote to memory of 2044	4524	Unicorn-64077.exe	101
PID 4524 wrote to memory of 2044	4524	Unicorn-64077.exe	101
PID 2800 wrote to memory of 184	2800	715ac5644fb3d5f894c23a74d77e7b65b83d8ced4d08ffa25c729714f81c70fcN.exe	100
PID 2800 wrote to memory of 184	2800	715ac5644fb3d5f894c23a74d77e7b65b83d8ced4d08ffa25c729714f81c70fcN.exe	100
PID 2800 wrote to memory of 184	2800	715ac5644fb3d5f894c23a74d77e7b65b83d8ced4d08ffa25c729714f81c70fcN.exe	100
PID 2980 wrote to memory of 4012	2980	Unicorn-12209.exe	102
PID 2980 wrote to memory of 4012	2980	Unicorn-12209.exe	102
PID 2980 wrote to memory of 4012	2980	Unicorn-12209.exe	102
PID 3428 wrote to memory of 3792	3428	Unicorn-56610.exe	103
PID 3428 wrote to memory of 3792	3428	Unicorn-56610.exe	103
PID 3428 wrote to memory of 3792	3428	Unicorn-56610.exe	103
PID 2808 wrote to memory of 4076	2808	Unicorn-36818.exe	104
PID 2808 wrote to memory of 4076	2808	Unicorn-36818.exe	104
PID 2808 wrote to memory of 4076	2808	Unicorn-36818.exe	104
PID 2008 wrote to memory of 3212	2008	Unicorn-12240.exe	105
PID 2008 wrote to memory of 3212	2008	Unicorn-12240.exe	105
PID 2008 wrote to memory of 3212	2008	Unicorn-12240.exe	105
PID 3396 wrote to memory of 1812	3396	Unicorn-28022.exe	106
PID 3396 wrote to memory of 1812	3396	Unicorn-28022.exe	106
PID 3396 wrote to memory of 1812	3396	Unicorn-28022.exe	106
PID 2656 wrote to memory of 2756	2656	Unicorn-2099.exe	107
PID 2656 wrote to memory of 2756	2656	Unicorn-2099.exe	107
PID 2656 wrote to memory of 2756	2656	Unicorn-2099.exe	107
PID 1504 wrote to memory of 3868	1504	Unicorn-42910.exe	108
PID 1504 wrote to memory of 3868	1504	Unicorn-42910.exe	108
PID 1504 wrote to memory of 3868	1504	Unicorn-42910.exe	108
PID 2816 wrote to memory of 3944	2816	Unicorn-40274.exe	109

C:\Users\Admin\AppData\Local\Temp\715ac5644fb3d5f894c23a74d77e7b65b83d8ced4d08ffa25c729714f81c70fcN.exe
"C:\Users\Admin\AppData\Local\Temp\715ac5644fb3d5f894c23a74d77e7b65b83d8ced4d08ffa25c729714f81c70fcN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12209.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12209.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42910.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42910.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36818.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56610.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25858.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9049.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27306.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11841.exe
        9⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53274.exe
        10⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8328.exe
        10⤵
        
        PID:10952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15242.exe
        10⤵
        
        PID:14808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11367.exe
        10⤵
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43688.exe
        9⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27263.exe
        9⤵
        
        PID:10560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23838.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:14984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52000.exe
        9⤵
        
        PID:18212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44685.exe
        8⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61804.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:8568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12848.exe
        9⤵
        
        PID:12840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18166.exe
        9⤵
        
        PID:16164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44788.exe
        8⤵
        
        PID:7872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37021.exe
        8⤵
        
        PID:11284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38098.exe
        8⤵
        
        PID:15188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57324.exe
        8⤵
        
        PID:17904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15608.exe
        7⤵
        Executes dropped EXE
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27986.exe
        8⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63642.exe
        9⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1067.exe
        9⤵
        
        PID:8632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45420.exe
        9⤵
        
        PID:14420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10102.exe
        9⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48245.exe
        8⤵
        
        PID:7752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39988.exe
        8⤵
        
        PID:10984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
        8⤵
        
        PID:14312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9718.exe
        8⤵
        
        PID:16692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39536.exe
        7⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63362.exe
        8⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13528.exe
        8⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40899.exe
        8⤵
        
        PID:15156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16987.exe
        8⤵
        
        PID:17924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31769.exe
        7⤵
        
        PID:8200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29891.exe
        7⤵
        
        PID:12192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10811.exe
        7⤵
        
        PID:15048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35469.exe
        7⤵
        
        PID:17464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62889.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56086.exe
        7⤵
        Executes dropped EXE
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10091.exe
        8⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35018.exe
        9⤵
        
        PID:10252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24475.exe
        9⤵
        
        PID:14288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12902.exe
        9⤵
        
        PID:17016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27597.exe
        8⤵
        
        PID:9464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29839.exe
        8⤵
        
        PID:13216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6675.exe
        8⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62749.exe
        7⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51110.exe
        8⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13528.exe
        8⤵
        
        PID:8232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40899.exe
        8⤵
        
        PID:15052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11943.exe
        8⤵
        
        PID:17620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25903.exe
        7⤵
        
        PID:8208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50809.exe
        7⤵
        
        PID:12072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15094.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18403.exe
        7⤵
        
        PID:18360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33235.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11841.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61804.exe
        8⤵
        
        PID:8544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12848.exe
        8⤵
        
        PID:12868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18166.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55644.exe
        7⤵
        
        PID:8580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18904.exe
        7⤵
        
        PID:11740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24030.exe
        7⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23219.exe
        7⤵
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6916.exe
        6⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14545.exe
        7⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34140.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26064.exe
        7⤵
        
        PID:15844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41988.exe
        6⤵
        
        PID:7864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11820.exe
        6⤵
        
        PID:11316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26377.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51898.exe
        6⤵
        
        PID:17604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55193.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58250.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2801.exe
        7⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11841.exe
        8⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25926.exe
        9⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8956.exe
        9⤵
        
        PID:9848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32063.exe
        9⤵
        
        PID:12708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10102.exe
        9⤵
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64197.exe
        8⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17774.exe
        9⤵
        
        PID:12700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52732.exe
        9⤵
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53977.exe
        9⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11015.exe
        8⤵
        
        PID:9392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4823.exe
        8⤵
        
        PID:13768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16002.exe
        8⤵
        
        PID:16908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52853.exe
        7⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13673.exe
        8⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8956.exe
        8⤵
        
        PID:9856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27979.exe
        8⤵
        
        PID:12992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36536.exe
        8⤵
        
        PID:16412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46220.exe
        7⤵
        
        PID:7452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21732.exe
        7⤵
        
        PID:10668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51555.exe
        7⤵
        
        PID:14280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8751.exe
        7⤵
        
        PID:17372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19500.exe
        6⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56958.exe
        7⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22610.exe
        8⤵
        
        PID:1128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16548.exe
        8⤵
        
        PID:9292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4387.exe
        8⤵
        
        PID:13804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10102.exe
        8⤵
        
        PID:16696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52521.exe
        7⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11207.exe
        7⤵
        
        PID:10904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52820.exe
        7⤵
        
        PID:13916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21970.exe
        7⤵
        
        PID:16840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35417.exe
        6⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36990.exe
        7⤵
        
        PID:9908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14244.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30670.exe
        7⤵
        
        PID:16420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46560.exe
        6⤵
        
        PID:7468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54145.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23740.exe
        6⤵
        
        PID:15768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43568.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39366.exe
        6⤵
        
        PID:1360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19626.exe
        7⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62137.exe
        8⤵
        
        PID:8668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33651.exe
        8⤵
        
        PID:12164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61092.exe
        8⤵
        
        PID:14784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39755.exe
        8⤵
        
        PID:18328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23076.exe
        7⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23179.exe
        7⤵
        
        PID:10708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46764.exe
        7⤵
        
        PID:15112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11830.exe
        7⤵
        
        PID:17536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48769.exe
        6⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42646.exe
        7⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8956.exe
        7⤵
        
        PID:9888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32063.exe
        7⤵
        
        PID:13208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36536.exe
        7⤵
        
        PID:4312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33583.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36917.exe
        6⤵
        
        PID:10624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51555.exe
        6⤵
        
        PID:14316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8751.exe
        6⤵
        
        PID:17380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26849.exe
        5⤵
        
        PID:4556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23902.exe
        6⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42174.exe
        7⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61421.exe
        7⤵
        
        PID:11168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27878.exe
        7⤵
        
        PID:14696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60568.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27352.exe
        6⤵
        
        PID:7236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27263.exe
        6⤵
        
        PID:10740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46764.exe
        6⤵
        
        PID:15104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11830.exe
        6⤵
        
        PID:17544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64556.exe
        5⤵
        
        PID:5836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32226.exe
        6⤵
        
        PID:7276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1468.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5642.exe
        6⤵
        
        PID:14556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62872.exe
        6⤵
        
        PID:18300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18244.exe
        5⤵
        
        PID:8080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17593.exe
        5⤵
        
        PID:11640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5614.exe
        5⤵
        
        PID:13332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48675.exe
        5⤵
        
        PID:18048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12240.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55946.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44410.exe
        7⤵
        
        PID:464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6340.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49434.exe
        9⤵
        
        PID:10712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36535.exe
        9⤵
        
        PID:12964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        9⤵
        
        PID:17392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26863.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10736.exe
        8⤵
        
        PID:11604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43431.exe
        8⤵
        
        PID:16332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64151.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45453.exe
        7⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59382.exe
        8⤵
        
        PID:9172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29812.exe
        8⤵
        
        PID:13292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50323.exe
        8⤵
        
        PID:15980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6749.exe
        8⤵
        
        PID:17852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4332.exe
        7⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15091.exe
        7⤵
        
        PID:12412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48911.exe
        7⤵
        
        PID:15732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20440.exe
        7⤵
        
        PID:1068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28628.exe
        6⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6340.exe
        7⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58858.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25539.exe
        8⤵
        
        PID:14648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49799.exe
        8⤵
        
        PID:17744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2359.exe
        7⤵
        
        PID:8552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10736.exe
        7⤵
        
        PID:11596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28114.exe
        7⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39647.exe
        7⤵
        
        PID:6392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35417.exe
        6⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59138.exe
        7⤵
        
        PID:10320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58492.exe
        7⤵
        
        PID:13724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12902.exe
        7⤵
        
        PID:16884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42476.exe
        6⤵
        
        PID:6964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24212.exe
        6⤵
        
        PID:13112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23740.exe
        6⤵
        
        PID:14828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14264.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56854.exe
        6⤵
        
        PID:1356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48598.exe
        7⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56434.exe
        8⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41820.exe
        8⤵
        
        PID:10444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13322.exe
        8⤵
        
        PID:12584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17615.exe
        8⤵
        
        PID:17304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44353.exe
        7⤵
        
        PID:7612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3549.exe
        8⤵
        
        PID:9224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64059.exe
        8⤵
        
        PID:13740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18767.exe
        8⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39988.exe
        7⤵
        
        PID:10972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52820.exe
        7⤵
        
        PID:13892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56364.exe
        7⤵
        
        PID:17652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57705.exe
        6⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49626.exe
        7⤵
        
        PID:10312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15155.exe
        7⤵
        
        PID:14100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35523.exe
        7⤵
        
        PID:16764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37580.exe
        6⤵
        
        PID:8152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25729.exe
        6⤵
        
        PID:11576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26614.exe
        6⤵
        
        PID:13784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58476.exe
        6⤵
        
        PID:18036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46256.exe
        5⤵
        
        PID:1072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19626.exe
        6⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35246.exe
        7⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6792.exe
        7⤵
        
        PID:11240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9430.exe
        7⤵
        
        PID:13832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2239.exe
        7⤵
        
        PID:1840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12448.exe
        6⤵
        
        PID:7884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49116.exe
        6⤵
        
        PID:10384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
        6⤵
        
        PID:12960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10102.exe
        6⤵
        
        PID:1820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45401.exe
        5⤵
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55142.exe
        6⤵
        
        PID:9156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21260.exe
        6⤵
        
        PID:12720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20198.exe
        6⤵
        
        PID:15824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28576.exe
        6⤵
        
        PID:2424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23103.exe
        5⤵
        
        PID:8216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25608.exe
        5⤵
        
        PID:11196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44021.exe
        5⤵
        
        PID:15144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
        5⤵
        
        PID:18428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29011.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5349.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45526.exe
        6⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53066.exe
        7⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56017.exe
        8⤵
        
        PID:13708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64320.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64493.exe
        7⤵
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28031.exe
        7⤵
        
        PID:11608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35280.exe
        7⤵
        
        PID:13272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9474.exe
        7⤵
        
        PID:18020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38052.exe
        6⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60238.exe
        7⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21120.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29414.exe
        7⤵
        
        PID:15340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18139.exe
        7⤵
        
        PID:18076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-247.exe
        6⤵
        
        PID:7428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53741.exe
        6⤵
        
        PID:11868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17870.exe
        6⤵
        
        PID:1620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21527.exe
        6⤵
        
        PID:18248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41612.exe
        5⤵
        
        PID:4880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15816.exe
        6⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2257.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34475.exe
        7⤵
        
        PID:15548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9690.exe
        7⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49360.exe
        6⤵
        
        PID:8276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-212.exe
        6⤵
        
        PID:13064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23210.exe
        6⤵
        
        PID:15424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26665.exe
        6⤵
        
        PID:6780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60881.exe
        5⤵
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23202.exe
        6⤵
        
        PID:9680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47109.exe
        6⤵
        
        PID:12392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-930.exe
        6⤵
        
        PID:16144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6295.exe
        5⤵
        
        PID:9564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13304.exe
        5⤵
        
        PID:13160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23740.exe
        5⤵
        
        PID:16356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41649.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32698.exe
        5⤵
        
        PID:4052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3865.exe
        6⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8977.exe
        7⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31683.exe
        7⤵
        
        PID:13988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18802.exe
        7⤵
        
        PID:16812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44265.exe
        6⤵
        
        PID:8036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35280.exe
        6⤵
        
        PID:13692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9474.exe
        6⤵
        
        PID:18064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17440.exe
        5⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61804.exe
        6⤵
        
        PID:9080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12848.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18166.exe
        6⤵
        
        PID:16196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1969.exe
        6⤵
        
        PID:7204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54684.exe
        5⤵
        
        PID:8288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38557.exe
        5⤵
        
        PID:12144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27346.exe
        5⤵
        
        PID:15068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18403.exe
        5⤵
        
        PID:17452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53892.exe
      4⤵
      PID:4752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9869.exe
        5⤵
        
        PID:6220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26658.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12223.exe
        6⤵
        
        PID:14020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12902.exe
        6⤵
        
        PID:4048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54161.exe
        5⤵
        
        PID:8560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13039.exe
        5⤵
        
        PID:11684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32696.exe
        5⤵
        
        PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26665.exe
        5⤵
        
        PID:7036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46780.exe
      4⤵
      PID:6560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12677.exe
        5⤵
        
        PID:10260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23323.exe
        5⤵
        
        PID:14224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14526.exe
        5⤵
        
        PID:17048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53566.exe
      4⤵
      PID:7632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14319.exe
      4⤵
      PID:12544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31903.exe
      4⤵
      PID:15856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46783.exe
      4⤵
      PID:18120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53901.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53901.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36190.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2469.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39174.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16362.exe
        7⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45557.exe
        8⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5012.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19266.exe
        8⤵
        
        PID:12368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1351.exe
        8⤵
        
        PID:16932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11156.exe
        7⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14597.exe
        8⤵
        
        PID:11148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45088.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61911.exe
        8⤵
        
        PID:16676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27213.exe
        7⤵
        
        PID:9756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37623.exe
        7⤵
        
        PID:12636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47131.exe
        7⤵
        
        PID:16116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27395.exe
        7⤵
        
        PID:6572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51125.exe
        6⤵
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15816.exe
        7⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49626.exe
        8⤵
        
        PID:10376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15155.exe
        8⤵
        
        PID:14120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35523.exe
        8⤵
        
        PID:16700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49360.exe
        7⤵
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13808.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23210.exe
        7⤵
        
        PID:16376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14413.exe
        7⤵
        
        PID:7028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65000.exe
        6⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62262.exe
        7⤵
        
        PID:9944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31683.exe
        7⤵
        
        PID:13944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40531.exe
        7⤵
        
        PID:17232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8032.exe
        6⤵
        
        PID:8624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59440.exe
        6⤵
        
        PID:12100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35891.exe
        6⤵
        
        PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2972.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34618.exe
        6⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44234.exe
        7⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36990.exe
        8⤵
        
        PID:9916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6219.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30670.exe
        8⤵
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35624.exe
        7⤵
        
        PID:8224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59884.exe
        7⤵
        
        PID:13052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31876.exe
        7⤵
        
        PID:15412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29028.exe
        6⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29837.exe
        7⤵
        
        PID:15616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61492.exe
        7⤵
        
        PID:18356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9095.exe
        6⤵
        
        PID:9552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38505.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23210.exe
        6⤵
        
        PID:16344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47085.exe
        6⤵
        
        PID:6040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45976.exe
        5⤵
        
        PID:5552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30010.exe
        6⤵
        
        PID:6912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8956.exe
        6⤵
        
        PID:9864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32063.exe
        6⤵
        
        PID:12652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36536.exe
        6⤵
        
        PID:16324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18260.exe
        5⤵
        
        PID:6972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8215.exe
        5⤵
        
        PID:9376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45159.exe
        5⤵
        
        PID:13752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16532.exe
        5⤵
        
        PID:16824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22926.exe
        5⤵
        
        PID:5076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56309.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59786.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59506.exe
        6⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48702.exe
        7⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57218.exe
        8⤵
        
        PID:10056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18471.exe
        8⤵
        
        PID:13564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6934.exe
        8⤵
        
        PID:16552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43506.exe
        8⤵
        
        PID:17508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60897.exe
        7⤵
        
        PID:9488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32639.exe
        7⤵
        
        PID:13184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56188.exe
        7⤵
        
        PID:688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64389.exe
        6⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1503.exe
        6⤵
        
        PID:9304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4823.exe
        6⤵
        
        PID:13776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16002.exe
        6⤵
        
        PID:16888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44493.exe
        5⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58053.exe
        6⤵
        
        PID:8696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33651.exe
        6⤵
        
        PID:11976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61092.exe
        6⤵
        
        PID:13228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22581.exe
        6⤵
        
        PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47912.exe
        5⤵
        
        PID:7316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44073.exe
        5⤵
        
        PID:10276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38098.exe
        5⤵
        
        PID:15036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60832.exe
        5⤵
        
        PID:17524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41020.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31494.exe
        5⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58053.exe
        6⤵
        
        PID:8944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46673.exe
        6⤵
        
        PID:13012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23210.exe
        6⤵
        
        PID:14644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50897.exe
        5⤵
        
        PID:8144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38592.exe
        5⤵
        
        PID:11056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33744.exe
        5⤵
        
        PID:14672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43927.exe
        5⤵
        
        PID:17204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35697.exe
      4⤵
      PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50238.exe
        5⤵
        
        PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53305.exe
        5⤵
        
        PID:9764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45419.exe
        5⤵
        
        PID:13980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
        5⤵
        
        PID:16844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43420.exe
      4⤵
      PID:7444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41648.exe
      4⤵
      PID:10680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52085.exe
      4⤵
      PID:14304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4286.exe
      4⤵
      PID:17404
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 17404 -s 464
        5⤵
        Program crash
        
        PID:2120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54756.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54756.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2469.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35090.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33061.exe
        6⤵
        
        PID:6332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45348.exe
        6⤵
        
        PID:11012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15712.exe
        6⤵
        
        PID:13244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62423.exe
        6⤵
        
        PID:16996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36324.exe
        5⤵
        
        PID:5588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44234.exe
        6⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59818.exe
        7⤵
        
        PID:11420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45384.exe
        7⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5798.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2473.exe
        7⤵
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35624.exe
        6⤵
        
        PID:8328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43548.exe
        6⤵
        
        PID:12984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27792.exe
        6⤵
        
        PID:15404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34979.exe
        5⤵
        
        PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48209.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17727.exe
        5⤵
        
        PID:11220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55632.exe
        5⤵
        
        PID:13836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10632.exe
        5⤵
        
        PID:4492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52173.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59506.exe
        5⤵
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45557.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5012.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44155.exe
        6⤵
        
        PID:13952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5435.exe
        6⤵
        
        PID:16956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15240.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59437.exe
        6⤵
        
        PID:18196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27213.exe
        5⤵
        
        PID:9748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37623.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47131.exe
        5⤵
        
        PID:14652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65244.exe
      4⤵
      PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13865.exe
        5⤵
        
        PID:6488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13040.exe
        5⤵
        
        PID:9820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32063.exe
        5⤵
        
        PID:13200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36536.exe
        5⤵
        
        PID:16396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42957.exe
      4⤵
      PID:7224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36995.exe
      4⤵
      PID:9540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26083.exe
      4⤵
      PID:13968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16532.exe
      4⤵
      PID:16964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30902.exe
      4⤵
      PID:3692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55489.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55489.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14669.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51146.exe
        5⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44234.exe
        6⤵
        
        PID:7000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35624.exe
        6⤵
        
        PID:8960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59884.exe
        6⤵
        
        PID:12972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31876.exe
        6⤵
        
        PID:15448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49449.exe
        5⤵
        
        PID:6668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35405.exe
        6⤵
        
        PID:13824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11035.exe
        6⤵
        
        PID:17104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5012.exe
        5⤵
        
        PID:10888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44155.exe
        5⤵
        
        PID:13840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58720.exe
        5⤵
        
        PID:17044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26812.exe
      4⤵
      PID:5388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44234.exe
        5⤵
        
        PID:7008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35624.exe
        5⤵
        
        PID:8448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43548.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31876.exe
        5⤵
        
        PID:3932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30948.exe
        5⤵
        
        PID:7152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42572.exe
      4⤵
      PID:6984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15033.exe
        5⤵
        
        PID:9720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26688.exe
        5⤵
        
        PID:12536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-930.exe
        5⤵
        
        PID:16092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14960.exe
      4⤵
      PID:9524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38911.exe
      4⤵
      PID:13320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9480.exe
      4⤵
      PID:17292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38220.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38220.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1945.exe
      4⤵
      PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50710.exe
        5⤵
        
        PID:6324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11525.exe
        6⤵
        
        PID:9324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27072.exe
        6⤵
        
        PID:13004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26010.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6749.exe
        6⤵
        
        PID:7188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41524.exe
        5⤵
        
        PID:8776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33459.exe
        5⤵
        
        PID:11424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61092.exe
        5⤵
        
        PID:14816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38820.exe
      4⤵
      PID:6524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49626.exe
        5⤵
        
        PID:10360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15155.exe
        5⤵
        
        PID:14144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35523.exe
        5⤵
        
        PID:16744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47668.exe
      4⤵
      PID:8392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43985.exe
      4⤵
      PID:12556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62323.exe
      4⤵
      PID:15952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34833.exe
      4⤵
      PID:5256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55229.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55229.exe
    3⤵
    PID:5496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11177.exe
      4⤵
      PID:7128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35624.exe
      4⤵
      PID:8524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7943.exe
      4⤵
      PID:13264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56188.exe
      4⤵
      PID:3960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26864.exe
      4⤵
      PID:6344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11713.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11713.exe
    3⤵
    PID:6540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50831.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50831.exe
    3⤵
    PID:9512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3504.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3504.exe
    3⤵
    PID:13176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25387.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25387.exe
    3⤵
    PID:16032
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64077.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64077.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36818.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36818.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40274.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47394.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13709.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41250.exe
        7⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54986.exe
        8⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22961.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10162.exe
        9⤵
        
        PID:17560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62329.exe
        8⤵
        
        PID:7856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13807.exe
        8⤵
        
        PID:11416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54076.exe
        8⤵
        
        PID:15584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6890.exe
        8⤵
        
        PID:18380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15048.exe
        7⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59242.exe
        8⤵
        
        PID:12016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4159.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37739.exe
        8⤵
        
        PID:17480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55836.exe
        7⤵
        
        PID:8656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43985.exe
        7⤵
        
        PID:12480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58239.exe
        7⤵
        
        PID:15904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33444.exe
        6⤵
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63346.exe
        7⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42946.exe
        8⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60985.exe
        7⤵
        
        PID:8464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48836.exe
        7⤵
        
        PID:12240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36012.exe
        7⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30854.exe
        7⤵
        
        PID:18404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19691.exe
        6⤵
        
        PID:6408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53533.exe
        6⤵
        
        PID:8796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32195.exe
        6⤵
        
        PID:12664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-863.exe
        6⤵
        
        PID:15808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20440.exe
        6⤵
        
        PID:17844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43044.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16362.exe
        6⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45666.exe
        7⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36990.exe
        8⤵
        
        PID:9932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14244.exe
        8⤵
        
        PID:13028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30670.exe
        8⤵
        
        PID:16388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8084.exe
        7⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32691.exe
        7⤵
        
        PID:12232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52156.exe
        7⤵
        
        PID:15300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30854.exe
        7⤵
        
        PID:17444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52381.exe
        6⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17338.exe
        7⤵
        
        PID:10928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33219.exe
        7⤵
        
        PID:13976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12518.exe
        7⤵
        
        PID:16904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47668.exe
        6⤵
        
        PID:8400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43985.exe
        6⤵
        
        PID:12512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21482.exe
        6⤵
        
        PID:15792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7492.exe
        5⤵
        
        PID:5796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62137.exe
        6⤵
        
        PID:8660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33651.exe
        6⤵
        
        PID:12008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32696.exe
        6⤵
        
        PID:14716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39755.exe
        6⤵
        
        PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54624.exe
        5⤵
        
        PID:7392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56745.exe
        5⤵
        
        PID:2400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38629.exe
        5⤵
        
        PID:15020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51898.exe
        5⤵
        
        PID:17588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64477.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47150.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64358.exe
        6⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26694.exe
        7⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38312.exe
        7⤵
        
        PID:9708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45419.exe
        7⤵
        
        PID:13924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
        7⤵
        
        PID:16800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11488.exe
        6⤵
        
        PID:7596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11207.exe
        6⤵
        
        PID:10916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52820.exe
        6⤵
        
        PID:13940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9718.exe
        6⤵
        
        PID:16928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16288.exe
        5⤵
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58053.exe
        6⤵
        
        PID:8688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33651.exe
        6⤵
        
        PID:11972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32696.exe
        6⤵
        
        PID:14596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39755.exe
        6⤵
        
        PID:17856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57424.exe
        5⤵
        
        PID:6428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24961.exe
        5⤵
        
        PID:10344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38098.exe
        5⤵
        
        PID:15096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52280.exe
        5⤵
        
        PID:17572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16515.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17683.exe
        5⤵
        
        PID:6828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43165.exe
        5⤵
        
        PID:9152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4183.exe
        5⤵
        
        PID:12820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1631.exe
        5⤵
        
        PID:16136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35371.exe
        5⤵
        
        PID:17496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35697.exe
      4⤵
      PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27950.exe
        5⤵
        
        PID:8252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18956.exe
        5⤵
        
        PID:12156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30146.exe
        5⤵
        
        PID:15012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39520.exe
        5⤵
        
        PID:18424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5231.exe
      4⤵
      PID:7376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56745.exe
      4⤵
      PID:9692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38629.exe
      4⤵
      PID:15172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52858.exe
      4⤵
      PID:17936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41020.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41020.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2469.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2417.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13932.exe
        6⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15802.exe
        7⤵
        
        PID:8724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18279.exe
        7⤵
        
        PID:13644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18802.exe
        7⤵
        
        PID:16868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61892.exe
        6⤵
        
        PID:7332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13092.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26614.exe
        6⤵
        
        PID:14408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58476.exe
        6⤵
        
        PID:18056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61405.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54898.exe
        6⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10809.exe
        7⤵
        
        PID:10968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41491.exe
        7⤵
        
        PID:15076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42555.exe
        7⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31446.exe
        7⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8956.exe
        6⤵
        
        PID:9872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32063.exe
        6⤵
        
        PID:12732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10102.exe
        6⤵
        
        PID:16720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42101.exe
        5⤵
        
        PID:8108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23539.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8543.exe
        5⤵
        
        PID:14680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48541.exe
        5⤵
        
        PID:5004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27284.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50954.exe
        5⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11177.exe
        6⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65365.exe
        6⤵
        
        PID:9268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40808.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11071.exe
        6⤵
        
        PID:15480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22780.exe
        6⤵
        
        PID:6068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12692.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31373.exe
        6⤵
        
        PID:16172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25815.exe
        5⤵
        
        PID:9444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46673.exe
        5⤵
        
        PID:13020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23210.exe
        5⤵
        
        PID:16368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54144.exe
      4⤵
      PID:5572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54898.exe
        5⤵
        
        PID:6836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8956.exe
        5⤵
        
        PID:9840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27979.exe
        5⤵
        
        PID:12968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36536.exe
        5⤵
        
        PID:16428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42957.exe
      4⤵
      PID:7216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36995.exe
      4⤵
      PID:9548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26083.exe
      4⤵
      PID:13960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16532.exe
      4⤵
      PID:16836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22926.exe
      4⤵
      PID:1752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49624.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49624.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54358.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57394.exe
        5⤵
        
        PID:3384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15816.exe
        6⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36990.exe
        7⤵
        
        PID:9924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14244.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30670.exe
        7⤵
        
        PID:16096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43698.exe
        7⤵
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45276.exe
        6⤵
        
        PID:9228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1556.exe
        6⤵
        
        PID:13044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19126.exe
        6⤵
        
        PID:15832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6532.exe
        5⤵
        
        PID:1216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53469.exe
        6⤵
        
        PID:14572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32991.exe
        6⤵
        
        PID:4840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1015.exe
        5⤵
        
        PID:8440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34473.exe
        5⤵
        
        PID:12104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27346.exe
        5⤵
        
        PID:14468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46799.exe
        5⤵
        
        PID:17612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42956.exe
      4⤵
      PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15816.exe
        5⤵
        
        PID:7088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8401.exe
        6⤵
        
        PID:10520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65124.exe
        6⤵
        
        PID:12460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        6⤵
        
        PID:17316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49360.exe
        5⤵
        
        PID:7592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13808.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63667.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48664.exe
      4⤵
      PID:6308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23345.exe
        5⤵
        
        PID:13552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46832.exe
        5⤵
        
        PID:16440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61125.exe
      4⤵
      PID:8764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30659.exe
      4⤵
      PID:11508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35891.exe
      4⤵
      PID:15124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40285.exe
      4⤵
      PID:17876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47077.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47077.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19055.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19055.exe
    3⤵
    PID:5892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58053.exe
      4⤵
      PID:8704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33651.exe
      4⤵
      PID:11992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61092.exe
      4⤵
      PID:15028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9500.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9500.exe
    3⤵
    PID:6644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24994.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24994.exe
    3⤵
    PID:10744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17098.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17098.exe
    3⤵
    PID:15084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42479.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42479.exe
    3⤵
    PID:17640
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2099.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2099.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28022.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28022.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51862.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45998.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33850.exe
        6⤵
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10061.exe
        7⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7825.exe
        8⤵
        
        PID:10176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10303.exe
        8⤵
        
        PID:13460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5590.exe
        8⤵
        
        PID:16444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52817.exe
        7⤵
        
        PID:8432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28607.exe
        7⤵
        
        PID:12112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36012.exe
        7⤵
        
        PID:14992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30854.exe
        7⤵
        
        PID:17428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7264.exe
        6⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43134.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62345.exe
        7⤵
        
        PID:10756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32504.exe
        7⤵
        
        PID:15464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2998.exe
        7⤵
        
        PID:18032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14413.exe
        7⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9375.exe
        6⤵
        
        PID:8320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26305.exe
        6⤵
        
        PID:12040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15094.exe
        6⤵
        
        PID:14856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18403.exe
        6⤵
        
        PID:17472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1732.exe
        5⤵
        
        PID:3388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13953.exe
        6⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6917.exe
        7⤵
        
        PID:12084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41491.exe
        7⤵
        
        PID:14956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42555.exe
        7⤵
        
        PID:18264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43698.exe
        7⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25239.exe
        6⤵
        
        PID:9072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12848.exe
        6⤵
        
        PID:12852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18166.exe
        6⤵
        
        PID:16188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47085.exe
        6⤵
        
        PID:18332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61840.exe
        5⤵
        
        PID:6692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47374.exe
        6⤵
        
        PID:12292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34475.exe
        6⤵
        
        PID:15592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61701.exe
        5⤵
        
        PID:8612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35319.exe
        5⤵
        
        PID:12504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45787.exe
        5⤵
        
        PID:15928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43731.exe
        5⤵
        
        PID:6904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9796.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16362.exe
        5⤵
        
        PID:1004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38650.exe
        6⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17914.exe
        7⤵
        
        PID:10644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40619.exe
        7⤵
        
        PID:14292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28086.exe
        7⤵
        
        PID:17364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44841.exe
        6⤵
        
        PID:8352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20439.exe
        6⤵
        
        PID:12056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23760.exe
        6⤵
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30854.exe
        6⤵
        
        PID:18384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14124.exe
        5⤵
        
        PID:6360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43008.exe
        5⤵
        
        PID:8804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51577.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52427.exe
        5⤵
        
        PID:15324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23219.exe
        5⤵
        
        PID:5364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64860.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15816.exe
        5⤵
        
        PID:7056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57218.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18471.exe
        6⤵
        
        PID:13588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6934.exe
        6⤵
        
        PID:16536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45276.exe
        5⤵
        
        PID:9248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46673.exe
        5⤵
        
        PID:13076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23210.exe
        5⤵
        
        PID:6368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5328.exe
      4⤵
      PID:6588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32662.exe
        5⤵
        
        PID:10884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62960.exe
        5⤵
        
        PID:14796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5502.exe
        5⤵
        
        PID:936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53036.exe
      4⤵
      PID:8788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18784.exe
      4⤵
      PID:12520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22012.exe
      4⤵
      PID:15780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64447.exe
      4⤵
      PID:5856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19360.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19360.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58634.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45142.exe
        5⤵
        
        PID:2228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65318.exe
        6⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5748 -s 632
        7⤵
        Program crash
        
        PID:8632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23844.exe
        6⤵
        
        PID:8076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19863.exe
        6⤵
        
        PID:11584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35280.exe
        6⤵
        
        PID:15356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9474.exe
        6⤵
        
        PID:18012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55733.exe
        5⤵
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14161.exe
        6⤵
        
        PID:7652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13528.exe
        6⤵
        
        PID:10764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40899.exe
        6⤵
        
        PID:15196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41876.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42432.exe
        5⤵
        
        PID:8304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34473.exe
        5⤵
        
        PID:12132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15094.exe
        5⤵
        
        PID:14732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14319.exe
        5⤵
        
        PID:18372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51125.exe
      4⤵
      PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58302.exe
        5⤵
        
        PID:1784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7825.exe
        6⤵
        
        PID:10168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22555.exe
        6⤵
        
        PID:13472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5590.exe
        6⤵
        
        PID:16500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37528.exe
        6⤵
        
        PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28888.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7995.exe
        5⤵
        
        PID:11984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43796.exe
        5⤵
        
        PID:14608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63335.exe
        5⤵
        
        PID:17672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65000.exe
      4⤵
      PID:6288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38194.exe
        5⤵
        
        PID:13356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57392.exe
        5⤵
        
        PID:16472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8032.exe
      4⤵
      PID:8616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16428.exe
      4⤵
      PID:12924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18696.exe
      4⤵
      PID:16124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56588.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56588.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16362.exe
      4⤵
      PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49750.exe
        5⤵
        
        PID:5340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14545.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34140.exe
        6⤵
        
        PID:11856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20670.exe
        6⤵
        
        PID:14552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46728.exe
        6⤵
        
        PID:18268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36672.exe
        5⤵
        
        PID:8336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20439.exe
        5⤵
        
        PID:12048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23760.exe
        5⤵
        
        PID:14880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63335.exe
        5⤵
        
        PID:3856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55541.exe
      4⤵
      PID:6232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7633.exe
        5⤵
        
        PID:9164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50760.exe
        5⤵
        
        PID:13860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18802.exe
        5⤵
        
        PID:16852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59152.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19672.exe
      4⤵
      PID:11664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45411.exe
      4⤵
      PID:15556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50305.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50305.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15816.exe
      4⤵
      PID:7044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3549.exe
        5⤵
        
        PID:8596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50760.exe
        5⤵
        
        PID:13744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18802.exe
        5⤵
        
        PID:16896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49360.exe
      4⤵
      PID:9240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42589.exe
      4⤵
      PID:13248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47523.exe
      4⤵
      PID:16020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37311.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37311.exe
    3⤵
    PID:6376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18490.exe
      4⤵
      PID:11212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61232.exe
      4⤵
      PID:14260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61911.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23672.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23672.exe
    3⤵
    PID:8812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43442.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43442.exe
    3⤵
    PID:9576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31426.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31426.exe
    3⤵
    PID:14628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13419.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13419.exe
    3⤵
    PID:18240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4729.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4729.exe
    3⤵
    PID:6764
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60621.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60621.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50445.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50445.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35282.exe
      4⤵
      PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27986.exe
        5⤵
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30970.exe
        6⤵
        
        PID:6176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53305.exe
        6⤵
        
        PID:9500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64495.exe
        6⤵
        
        PID:13760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
        6⤵
        
        PID:16876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20040.exe
        5⤵
        
        PID:7384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42138.exe
        6⤵
        
        PID:11756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15679.exe
        6⤵
        
        PID:4800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12274.exe
        6⤵
        
        PID:18092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23075.exe
        5⤵
        
        PID:10328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34756.exe
        5⤵
        
        PID:14136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32722.exe
        5⤵
        
        PID:16712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17632.exe
      4⤵
      PID:6136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2537.exe
        5⤵
        
        PID:10796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22311.exe
        5⤵
        
        PID:14740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1226.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42624.exe
      4⤵
      PID:8052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13860.exe
      4⤵
      PID:12264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10434.exe
      4⤵
      PID:3936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54968.exe
      4⤵
      PID:17752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-563.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-563.exe
    3⤵
    PID:1248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27986.exe
      4⤵
      PID:5908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5993.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13528.exe
        5⤵
        
        PID:10752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40899.exe
        5⤵
        
        PID:15164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16987.exe
        5⤵
        
        PID:17916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15100.exe
      4⤵
      PID:6676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27263.exe
      4⤵
      PID:10428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23838.exe
      4⤵
      PID:14836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52000.exe
      4⤵
      PID:17996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37233.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37233.exe
    3⤵
    PID:1568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52942.exe
      4⤵
      PID:10236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18279.exe
      4⤵
      PID:13636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18802.exe
      4⤵
      PID:16860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39824.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39824.exe
    3⤵
    PID:4364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54197.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54197.exe
    3⤵
    PID:11996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60549.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60549.exe
    3⤵
    PID:14724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
    3⤵
    PID:18396
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46824.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46824.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59786.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59786.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12972.exe
      4⤵
      PID:5492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64218.exe
        5⤵
        
        PID:7624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26252.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22066.exe
        5⤵
        
        PID:13260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26552.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18015.exe
      4⤵
      PID:7956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30477.exe
      4⤵
      PID:9456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7974.exe
      4⤵
      PID:13336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59104.exe
      4⤵
      PID:3904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32816.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32816.exe
    3⤵
    PID:6012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45469.exe
      4⤵
      PID:9288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34450.exe
      4⤵
      PID:14024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16187.exe
      4⤵
      PID:16728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65400.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65400.exe
    3⤵
    PID:7672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33129.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33129.exe
    3⤵
    PID:10776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7303.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7303.exe
    3⤵
    PID:15364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3528.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3528.exe
    3⤵
    PID:5308
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21684.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21684.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31494.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31494.exe
    3⤵
    PID:5448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18526.exe
      4⤵
      PID:6704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62817.exe
      4⤵
      PID:9728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45419.exe
      4⤵
      PID:13932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
      4⤵
      PID:16916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7788.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7788.exe
    3⤵
    PID:7368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12153.exe
      4⤵
      PID:12764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11507.exe
      4⤵
      PID:16080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23075.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23075.exe
    3⤵
    PID:10336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34756.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34756.exe
    3⤵
    PID:14128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32722.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32722.exe
    3⤵
    PID:16736
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3441.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3441.exe
  2⤵
  PID:5756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54898.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54898.exe
    3⤵
    PID:6852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8956.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8956.exe
    3⤵
    PID:9880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32063.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32063.exe
    3⤵
    PID:12540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36536.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36536.exe
    3⤵
    PID:16404
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12907.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12907.exe
  2⤵
  PID:7352
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22528.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22528.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:10348
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3955.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3955.exe
  2⤵
  PID:14152
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48388.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48388.exe
  2⤵
  PID:16756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5748 -ip 5748
1⤵
PID:8720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 17404 -ip 17404
1⤵
PID:5368

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:12676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12209.exe

Filesize
184KB

MD5
9a38424258be9909fc756d47a7efcc97

SHA1
c51ab79c79894be7ef1efd6044c1dd669151bc4c

SHA256
78f8759fd48498f181240b8386046a77af3b90304babaa9dc1aa6fce62dcc1f1

SHA512
3611bba30e2afabff740d8d8b49e8cbd017cf1f8d8ec6448471a311a7d14fe40ab2b7c3f71987486d5f5d4ebdf3dfb6b5ddcb9acd3512432b87acef05b539201

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12240.exe

Filesize
184KB

MD5
ae3b1da26a0815844785486009bf63e5

SHA1
feb290a3c93f4a1bbfa24e02d828dcaac485038e

SHA256
44ca53f2a5a20484a6eaa5b5da6d9acb0c90690bcfbc02ed473f8632ec49da77

SHA512
0a4e523600c8185ec53b10f7caf7e501d868dd5b9f6f209c23801faa8bd7ac87b044eb22ffe2b0615d4ac1c6667d3f1ff6435b5f971e4209f7fc9fc4a302bcad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19360.exe

Filesize
184KB

MD5
39b1f064d377099004e8ddf3c6b00a8a

SHA1
40638aa135396126bed2933fedd49034899fd2c1

SHA256
4096d06f37288693409ad065e875cd5cd488f0faf89928d6918d230a885d58e9

SHA512
ec88a78f2b384f9f58dcb8ac92f81372406342f0e5e517e970d830b3dc0acef3011c50b69736659173f31aebce5260f7e4238c630b45938dcc5f09d8c98a84e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2099.exe

Filesize
184KB

MD5
100e51496c10233444d57456fdb06228

SHA1
942e70f10356162b02fb46d07bd17098ff0d9bce

SHA256
3746e2d5e6d953141c7e7399adc4fa097f542c62a33057cfe079898b27933091

SHA512
bf8ee85493e53bd49150481e1dcc00da45d7e956f79df7d0a3369284c685ad19f6ffae30800f1404df814b617057af3a4abd2c335a421125aec5fa8f9bdc3904

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2469.exe

Filesize
184KB

MD5
333aa8572a508b3788538f8c9128ecd7

SHA1
9d102b7685f1c393bd70ccdc9ebdca8d920a95ee

SHA256
0ae5d342b96992977460cd63b312a0b4171c25f144c14027fb16500ceb4ea987

SHA512
ae23120fc0ad4b8a399f1d3d7b2e86ffec1fba88da3002ec5067a9a62c96f2be7f4320a8ed5b4310c90f0f6a789cbd8cbfeed260d3addf17c6b7f3d9d81309aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25858.exe

Filesize
184KB

MD5
b52343ab085bac4543c38ce52cb6c3ee

SHA1
73ef7c1e1302bde5d8a8228fb6c02475a0c7c1dd

SHA256
f13e36622d2aba214897692a00c4058122f8fb9a17b965b1c2029de80be36a8e

SHA512
af482138f3b8ea28c191efd918066d3066c20134c9c3b0f2ac59e82bed2ce47b8ba6262cc125a6a5ae679f4e866813e5a3c45aff2e29c1e8d398ce64237d1f66

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28022.exe

Filesize
184KB

MD5
319c099b7e4027fdd18053ff4c5dab99

SHA1
ef43481b4978fae8718f4056c4a346750908f085

SHA256
bb3991911ebaf5a04ce57c6537e18a277ee47ac0b003cc5ebc2eaa42c8bc1b7e

SHA512
c24e9f999378cf7e25dcfaf1b886d09819ea6defd48bbf06e84eb535a43490bdb838d90a72c87e1a54f7bf2d15163baa8b28dd694fe86ed634c2f7ca6b67fe1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29011.exe

Filesize
184KB

MD5
704ac5305487daa9f53071faed79edba

SHA1
cbfa31746096a4ab2e189cc176812d5d526040e3

SHA256
50ef2f5421be4dfd521e090f61899362ea0b06f315783572a7846f1f7cd85862

SHA512
896a42f8328126774d7db5208ccef2fc88607ac45033b393d2b9eecefd4afc68eb5636e837faf5f2f37f7e3d72dc171389eead38103bb845433241b344b3a74c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30534.exe

Filesize
184KB

MD5
a7a64072dd956460ee6f2e736d468258

SHA1
b1f53db68d4b659d548b33383ae1614e843ce989

SHA256
33add6d1266d0840c41a894e16c3d5dd014ac925b323e111ccd50a65856109fa

SHA512
140fa8292bac3cca1de61697a497850b66b93afbb9e755686516d80cc56c8b126e914b8d977ee5af0492d167c03d4c1e759a6d8bb94ea9b2183218e2369466c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36190.exe

Filesize
184KB

MD5
10b9bab2ef199685b296732351c96449

SHA1
c3c154a0ee83a01001d285aef13cd47ffcaf618f

SHA256
f4b1bbb31b6f8c7063aaffb9c3a5cf7a158517ff20f1373031fe162b713513eb

SHA512
a9b452476270ef89553c824b8e9dc3c7ed6c8693b403dbfc1f7210374e3389366038622254bc3df3461a54df80004462f2f4c99925ce2cbaa95816d3f2af05ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36818.exe

Filesize
184KB

MD5
9dccfad1aaab6830506b651b02490a5a

SHA1
5ff4bb8b6f4ca36053acc15a4c46e8d98832dfb4

SHA256
94e8ac8412f1d5f2f1a22e56da706154b36ebed817678c7809883c2c434a8834

SHA512
81fdffb7bf7dc55d4c66cbd7e9cc60125b0c375910776ee34c20041b51e9b9e5acb3db6eabda18b959df5978ff64c83884a0686dd0fd68366148eb25b85628e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40274.exe

Filesize
184KB

MD5
be4de492930ffcfddf971b09d85a1c45

SHA1
4982092dd737b83429331f916a4cc5ec30166e67

SHA256
8de49eb6ffcfed1afd0754438087923d694b3ac1fc9939deb2060a61d0773ddd

SHA512
e4f9d6676525c841f333c915481a71e95f5a974562911c689785b92930204e31467b558dcc24915733f513afd053bc6e943df24e9845aef7732fbf67be59faad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41020.exe

Filesize
184KB

MD5
a7d4cb4ca94a853332b20dddf091a7d6

SHA1
9d9b38bc4d27d999c6765a15ed0b56eb5b5b0b73

SHA256
95650b8b1bc58c724411ce8cf3058a4c25a3154ce1e88fac43efa158148582f3

SHA512
35c8b2fa0d701c91ebe154e85c2a3162cab987ecd28a13f89bd730b5a2e99f258c370e72d458631ad9559b0f75c4015248647eb4b15492c44bd40a0497ddd4cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42910.exe

Filesize
184KB

MD5
b2184818ef1ed59c3f2c72178c2fd853

SHA1
f549fb6231acc78832573c96ff859525e9083e70

SHA256
c0ed0a0b9ff42028eae66dee241af2b6f14d265be685e5a7e74b6b4fa7afd927

SHA512
7e6ac427baa20fb0eb3b82611206b35acba5a55990212743cd5c494d55563086a7fce756216ffd322b328112001a7203ebef3d6c205755a191b8d8a833e94f8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46824.exe

Filesize
184KB

MD5
0ecf1724b5c4d15e80419006437ab8ab

SHA1
2c0e422662bf123e7bf60eea1bbd42043345a9ca

SHA256
0168d3b45349932ff71532c03bb8504afab8c68de374721b77ddc76259acda8a

SHA512
80c73c16fa1c0efe19c4c4c7fb92d1c4b0145e243ed9975038a298e180f9822ed8b7f397989bc9bd38ca3a45833e01b4e702c11175073ba73745829a1df225f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47394.exe

Filesize
184KB

MD5
7a50a72574f98c9edb6268c001621b67

SHA1
2cf32a58e74313a18e1785aeb2669fb5ad20843a

SHA256
bf9cb047cf188971fba0af749d62f7601997254c01cb87935955b1d0dfe6a0c0

SHA512
ad37766f68e93deb38a051b205cbae6c05c43ff6b5a3e91ccb834a63eb77593cde4fc2acc868e5b1340a36e5fa07bafcf2dcd01d491b04531b637afee864c2a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49624.exe

Filesize
184KB

MD5
42cad7110d4516b19ba509fb00b3eb80

SHA1
18f964843fd9c5b4c69c513e736adb0a30d6875a

SHA256
a78c8725d30aea87fc27b4d2672ee61ad0aa9938ebdb28f257c343f719cb683f

SHA512
3b4e129761dfd6088b88d5b45edbf104b9e434d2123549f2594ea76ea4dc19f6c9bf96ae33892e48b100b12c53d095aeae7b8c1870873f37fa0e09ec21e998aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50954.exe

Filesize
184KB

MD5
fe392c4b1baab2ec734d15dc93beabc8

SHA1
6417e7d172c00c24d18e735a26ac8c190749e591

SHA256
06835083c7c6c8afc2abc87055a75bb23e9130cefb1733d97202e711cfa89f70

SHA512
44e9ba216023917faaf896943fd9725a87d14ba14f56a7355677cc0fcf743b2c13ff0e5f7e487a8af9267b0297aafff35f98396a1945f83c1eedb18e21bb81af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51862.exe

Filesize
184KB

MD5
ff8c67b6da52aab056ab9a69df2d1430

SHA1
608d376e7043aecb71e025877aab13fb31f408cd

SHA256
5d3e03298a55c96638b2e79bb0e51030d61b674be4bc7e4c5243512d2892de33

SHA512
4418381a78524742790b56de59ad658c4becc7e8dc47a426e50b1855c19800ef2cb322275e6f7a651e019b1c400f807ea04c1781ad1ecafa61d2e82a83dc08e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53901.exe

Filesize
184KB

MD5
e66feb6e33f67c0e23462b699439dcfc

SHA1
93ea006195cebf377e864dde3df2274b129b942c

SHA256
832f62acccfdbba488b2a26a8e163fa0a65f02a781533a202fba41b13da281f6

SHA512
b916ee9c47cdf897d5dbce333441628e00de0a110f43b51a3ccc1186f101dc13d6a44cec64d219fc13a1de9d97fa92ea7dec92ff241112b1af4bce0c9643c1b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54756.exe

Filesize
184KB

MD5
255c8c22c157f47797ace1475044c5f0

SHA1
642583715551060a03321903f3496acb7aff6282

SHA256
c871586040f03f69bb6694125a12a3f15723cc1a81aa1beac7b47f1ca2387ee7

SHA512
528539349a4f21f652465e697106c7d13b7b910df6529ec05b8c46bd2f915b72519933985cd22fdac32244d12bebc10695f908372ef39fd8eeb2a0d180fe4d30

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55193.exe

Filesize
184KB

MD5
c5dcb5fc87f4c4342d0df840fbca7656

SHA1
f444b8e3de6505d487a734e81e775be2d6ad7e3b

SHA256
ca9b3df5750dfc8cc47b90f9107e8ce63627e63163616f4f6463aac12a981006

SHA512
6e55b152f600b70516cf433e5394110327ecb4fb6c74f89c6be74512d826f2293f2e1d237c94242e3019586c084a17cbca8b4d8124add49676f260934f2975d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55489.exe

Filesize
184KB

MD5
f3af436c04d6a4e8dd953c183b4208cb

SHA1
650f2181d347220ac837483c902ae213a27ee15e

SHA256
e444762579e87687ffca6ff7df4d0c807a8024012c418e99ea5b9b770427c12c

SHA512
dd5d7019fe982569b465bee5038dc7221fbaeb1d8522b4c5361e6be9730e01c072587790cc02102bd5281b17deea59d79357614f797958abefdd18f45f2ba823

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55946.exe

Filesize
184KB

MD5
bfceff0d633388f4346d557178978044

SHA1
593211509b325875db3a2fa9e1a110fa08036596

SHA256
78d752b152b06fe1763be8007cec2168e98ffad72bf0d52ff67c8b6d15130fe4

SHA512
8fe3c0e5dd847524887f517495360b56e413d06cd28afbb5fc329900257a0410d91ec6bb0a4b6db281d2f521f8f312665f317717cd7e13ab4a835e59aaadad73

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56309.exe

Filesize
184KB

MD5
6dea2e4e8751b1bb87bbab8950f9d956

SHA1
db0bb703c5b134c48c521212095b26d229921e8b

SHA256
654f2a4775f60d3d93113c02daadb923467f527ad0b9dec430c505c52cf3c3b6

SHA512
0830c537e686b6f4937198bb793558b86adc35567a2eee5eb0e52eda96b6fff7e949b914771a04275f6f85949f1b7f80fd5de11f07ac8454b78f6939b4118876

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56610.exe

Filesize
184KB

MD5
b2e90226c4169e6bdde7a340c0544514

SHA1
7b7fbdc86bd6f3531af3e16ecf81830d657b6b3a

SHA256
a067d430f40942d6904309af03c1f42c30b1a03bc42b4269308179914c2419a2

SHA512
715537484612bc6ab5402c59dcc6388e69fa895b32843339910a823eed004ade9566a1541703948d40d524f36dc5f5ce9145c20d21282c106a2498e9e7d7619e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58250.exe

Filesize
184KB

MD5
3aad9022543f87cb6b9a34bc650cfe6b

SHA1
641b0ef335ca3d52ddcb6bf15f0acef79616eb14

SHA256
dc1e43fce724a541619e872af4d792231e249e629dd9e4cf03d2a5ae6c591da1

SHA512
0a9e328ff41c7c59576c53bc952c934e0f026f8b70da09587b8039f1682f37ce7a349dd88fd502de2ccca050c66af6fa575ddd1eba414b5a719157d1dd803ad5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60621.exe

Filesize
184KB

MD5
2c1051611415d15e924c4c41c62621cf

SHA1
0f1c265657460c4980fb9a8a1df8fca6b85c987f

SHA256
93c262db39f18ebfb350d1efda6dcfe2085dbbdeab2e846f8e1af45440b7080b

SHA512
053141ee2fe0ec017bcac90ffc5e1c8007e7b0be6f7575f5dc6d3852a0e0f1e95f11db33a1db81ea1387fe09bca178bb45601ada4367ae9f38b829aea80fcc9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62889.exe

Filesize
184KB

MD5
1315007c63490b41ef965e68bdbe4f87

SHA1
bd15526b5353d5989fa11928879efbcdcaa95a7f

SHA256
e58efb55f37cf899e5e8c9ac6c4c04a4e6ff3546db9ad04d3ac6e4f724b80d1d

SHA512
6943b66e5166e4349340ed27e9d4ffe642cdcb189440804d8cef25dc473c624cf58833af9977bd248df16a5c6b70f274411658caafad949a7294255eecf478f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64077.exe

Filesize
184KB

MD5
82f5509b60d3d010d296d5b985600fe6

SHA1
288100fc863bcddf351382fac3c613de7cac6ca3

SHA256
531b32b1bdbe6597af3451fd0f7eb37c0951773a8a0d6de78f5c04e2b4b21c9f

SHA512
1c14508e3ca115777694713d1711dbd3881cca5df632d88bb1d38aedab7f3b79d72a6772c0e4c3ac1c732140e226b3dbaafc006ca764c7a873888069a5f85985

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64477.exe

Filesize
184KB

MD5
5d41e2ad5a504274ea4b254e1ebda2e3

SHA1
6a7905c751daf05f82972b4f1eb9ce3192b435c8

SHA256
23979ca215cf672909b9d95bf193c83e8b3f2749cd7cac4d923dc518bb268c76

SHA512
1b152e2ffc33afd586f7360e94ae709065a220fff85bf83283adda844395b54dcfd34049464bc1644d1454d06602d544ab3dedfbc4991cdff6624a6cf3378bba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9049.exe

Filesize
184KB

MD5
1036a92b5d9a3c0f3fede2920b9de472

SHA1
00de68f40ca1a76a04747c59dd0545153326b397

SHA256
ff53dadeff9546ad2d249eb4e3557ec094c861a9cd92c19c3d8b4ed267a16e10

SHA512
7c5d6a000e391138c537881beac806eec808dc35336428629767f84a6d305b2fc5df96a1200494a6615a462c14938c9bad7d12131c0ba014e1a99bb1b7b36e75

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads