d87df20c96fd7f04930ef9e48d62c3d9432ec4df74627b491fcf2e02fcc93daf

Analysis

max time kernel
119s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 01:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d87df20c96fd7f04930ef9e48d62c3d9432ec4df74627b491fcf2e02fcc93dafN.exe
Size

468KB
MD5

f8090fbb33b2388d037ef1ad921d69b0
SHA1

106ca6cda093a537b203ce9dcf9d3f9f86f98736
SHA256

d87df20c96fd7f04930ef9e48d62c3d9432ec4df74627b491fcf2e02fcc93daf
SHA512

6233de4513b3e233292251b9a77eeaa4ca4577d68a87ebe3bb5a55fdb2b0910933d3219b46a61019245ae49fdf0d98d694ecd40d091099b2828a91f012a8f84c
SSDEEP

3072:L1thogLZay8Akb/TPz5Wff/cfzjWd8JnmHz5OVp2f2B3L15NCElj:L1/oBLAkXP1WffjyKTf25J5NC

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3196	Unicorn-35552.exe
4084	Unicorn-2428.exe
3028	Unicorn-15811.exe
1248	Unicorn-50636.exe
4636	Unicorn-33615.exe
2796	Unicorn-13749.exe
2504	Unicorn-27484.exe
1616	Unicorn-35276.exe
3096	Unicorn-527.exe
1676	Unicorn-20393.exe
4836	Unicorn-36236.exe
3716	Unicorn-35971.exe
3952	Unicorn-36236.exe
3168	Unicorn-12892.exe
4716	Unicorn-64694.exe
4604	Unicorn-56841.exe
2940	Unicorn-18422.exe
3160	Unicorn-16476.exe
4228	Unicorn-10795.exe
2896	Unicorn-26182.exe
376	Unicorn-26447.exe
1940	Unicorn-24370.exe
964	Unicorn-44428.exe
4496	Unicorn-7349.exe
2372	Unicorn-44236.exe
4532	Unicorn-329.exe
3568	Unicorn-22066.exe
3812	Unicorn-12139.exe
4608	Unicorn-54931.exe
432	Unicorn-34194.exe
3560	Unicorn-39378.exe
3156	Unicorn-42057.exe
4080	Unicorn-28818.exe
4356	Unicorn-936.exe
3216	Unicorn-16588.exe
2660	Unicorn-1512.exe
2656	Unicorn-1704.exe
1520	Unicorn-14475.exe
1812	Unicorn-65513.exe
1052	Unicorn-18626.exe
2552	Unicorn-17775.exe
4780	Unicorn-31510.exe
3564	Unicorn-44666.exe
4280	Unicorn-2015.exe
4236	Unicorn-15471.exe
4032	Unicorn-8617.exe
4744	Unicorn-2472.exe
4940	Unicorn-41772.exe
4000	Unicorn-22482.exe
624	Unicorn-12747.exe
1824	Unicorn-59369.exe
3840	Unicorn-46188.exe
3920	Unicorn-36218.exe
3164	Unicorn-57271.exe
2448	Unicorn-46188.exe
208	Unicorn-63401.exe
3844	Unicorn-38511.exe
3584	Unicorn-44112.exe
4732	Unicorn-6603.exe
1132	Unicorn-51127.exe
4400	Unicorn-23049.exe
3192	Unicorn-50167.exe
3480	Unicorn-62828.exe
3428	Unicorn-62828.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
9104	3456	WerFault.exe	786
17812	15416	WerFault.exe	821
17804	4452	WerFault.exe	823
17828	16344	WerFault.exe	816
17844	16236	WerFault.exe	806
17856	16344	WerFault.exe	816

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31532.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11848.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52044.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24972.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5842.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52044.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13954.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8354.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48660.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62429.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32844.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18897.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18179.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20956.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44717.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6579.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58634.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48262.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7010.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52044.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30319.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45485.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18921.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1318.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41135.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53264.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11467.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16847.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15881.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39490.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8354.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35906.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4206.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45131.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3042.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23049.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9682.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34732.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51433.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18626.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30220.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52044.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26630.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53917.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10539.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65149.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43249.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62171.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58634.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41348.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37228.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64691.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42057.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53917.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3572.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62317.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	6172	dwm.exe
Token: SeChangeNotifyPrivilege	6172	dwm.exe
Token: 33	6172	dwm.exe
Token: SeIncBasePriorityPrivilege	6172	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
232	d87df20c96fd7f04930ef9e48d62c3d9432ec4df74627b491fcf2e02fcc93dafN.exe
3196	Unicorn-35552.exe
4084	Unicorn-2428.exe
3028	Unicorn-15811.exe
1248	Unicorn-50636.exe
2504	Unicorn-27484.exe
4636	Unicorn-33615.exe
2796	Unicorn-13749.exe
3096	Unicorn-527.exe
1616	Unicorn-35276.exe
3168	Unicorn-12892.exe
3952	Unicorn-36236.exe
4836	Unicorn-36236.exe
4716	Unicorn-64694.exe
1676	Unicorn-20393.exe
3716	Unicorn-35971.exe
4604	Unicorn-56841.exe
2940	Unicorn-18422.exe
3160	Unicorn-16476.exe
2896	Unicorn-26182.exe
4228	Unicorn-10795.exe
3568	Unicorn-22066.exe
1940	Unicorn-24370.exe
4496	Unicorn-7349.exe
2372	Unicorn-44236.exe
4532	Unicorn-329.exe
3812	Unicorn-12139.exe
4608	Unicorn-54931.exe
376	Unicorn-26447.exe
964	Unicorn-44428.exe
432	Unicorn-34194.exe
3560	Unicorn-39378.exe
3156	Unicorn-42057.exe
4080	Unicorn-28818.exe
4356	Unicorn-936.exe
2656	Unicorn-1704.exe
3216	Unicorn-16588.exe
2660	Unicorn-1512.exe
1520	Unicorn-14475.exe
1812	Unicorn-65513.exe
1052	Unicorn-18626.exe
2552	Unicorn-17775.exe
4780	Unicorn-31510.exe
3564	Unicorn-44666.exe
4236	Unicorn-15471.exe
4032	Unicorn-8617.exe
4280	Unicorn-2015.exe
4744	Unicorn-2472.exe
624	Unicorn-12747.exe
3840	Unicorn-46188.exe
208	Unicorn-63401.exe
4000	Unicorn-22482.exe
4940	Unicorn-41772.exe
1824	Unicorn-59369.exe
3164	Unicorn-57271.exe
2448	Unicorn-46188.exe
3584	Unicorn-44112.exe
3844	Unicorn-38511.exe
3920	Unicorn-36218.exe
4732	Unicorn-6603.exe
1132	Unicorn-51127.exe
4400	Unicorn-23049.exe
3192	Unicorn-50167.exe
3480	Unicorn-62828.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 232 wrote to memory of 3196	232	d87df20c96fd7f04930ef9e48d62c3d9432ec4df74627b491fcf2e02fcc93dafN.exe	82
PID 232 wrote to memory of 3196	232	d87df20c96fd7f04930ef9e48d62c3d9432ec4df74627b491fcf2e02fcc93dafN.exe	82
PID 232 wrote to memory of 3196	232	d87df20c96fd7f04930ef9e48d62c3d9432ec4df74627b491fcf2e02fcc93dafN.exe	82
PID 3196 wrote to memory of 4084	3196	Unicorn-35552.exe	83
PID 3196 wrote to memory of 4084	3196	Unicorn-35552.exe	83
PID 3196 wrote to memory of 4084	3196	Unicorn-35552.exe	83
PID 232 wrote to memory of 3028	232	d87df20c96fd7f04930ef9e48d62c3d9432ec4df74627b491fcf2e02fcc93dafN.exe	84
PID 232 wrote to memory of 3028	232	d87df20c96fd7f04930ef9e48d62c3d9432ec4df74627b491fcf2e02fcc93dafN.exe	84
PID 232 wrote to memory of 3028	232	d87df20c96fd7f04930ef9e48d62c3d9432ec4df74627b491fcf2e02fcc93dafN.exe	84
PID 4084 wrote to memory of 1248	4084	Unicorn-2428.exe	85
PID 4084 wrote to memory of 1248	4084	Unicorn-2428.exe	85
PID 4084 wrote to memory of 1248	4084	Unicorn-2428.exe	85
PID 3028 wrote to memory of 4636	3028	Unicorn-15811.exe	87
PID 3028 wrote to memory of 4636	3028	Unicorn-15811.exe	87
PID 3028 wrote to memory of 4636	3028	Unicorn-15811.exe	87
PID 3196 wrote to memory of 2796	3196	Unicorn-35552.exe	86
PID 3196 wrote to memory of 2796	3196	Unicorn-35552.exe	86
PID 3196 wrote to memory of 2796	3196	Unicorn-35552.exe	86
PID 232 wrote to memory of 2504	232	d87df20c96fd7f04930ef9e48d62c3d9432ec4df74627b491fcf2e02fcc93dafN.exe	88
PID 232 wrote to memory of 2504	232	d87df20c96fd7f04930ef9e48d62c3d9432ec4df74627b491fcf2e02fcc93dafN.exe	88
PID 232 wrote to memory of 2504	232	d87df20c96fd7f04930ef9e48d62c3d9432ec4df74627b491fcf2e02fcc93dafN.exe	88
PID 1248 wrote to memory of 1616	1248	Unicorn-50636.exe	89
PID 1248 wrote to memory of 1616	1248	Unicorn-50636.exe	89
PID 1248 wrote to memory of 1616	1248	Unicorn-50636.exe	89
PID 4084 wrote to memory of 3096	4084	Unicorn-2428.exe	90
PID 4084 wrote to memory of 3096	4084	Unicorn-2428.exe	90
PID 4084 wrote to memory of 3096	4084	Unicorn-2428.exe	90
PID 2504 wrote to memory of 1676	2504	Unicorn-27484.exe	91
PID 2504 wrote to memory of 1676	2504	Unicorn-27484.exe	91
PID 2504 wrote to memory of 1676	2504	Unicorn-27484.exe	91
PID 2796 wrote to memory of 4836	2796	Unicorn-13749.exe	92
PID 2796 wrote to memory of 4836	2796	Unicorn-13749.exe	92
PID 2796 wrote to memory of 4836	2796	Unicorn-13749.exe	92
PID 4636 wrote to memory of 3952	4636	Unicorn-33615.exe	94
PID 4636 wrote to memory of 3952	4636	Unicorn-33615.exe	94
PID 4636 wrote to memory of 3952	4636	Unicorn-33615.exe	94
PID 232 wrote to memory of 3716	232	d87df20c96fd7f04930ef9e48d62c3d9432ec4df74627b491fcf2e02fcc93dafN.exe	93
PID 232 wrote to memory of 3716	232	d87df20c96fd7f04930ef9e48d62c3d9432ec4df74627b491fcf2e02fcc93dafN.exe	93
PID 232 wrote to memory of 3716	232	d87df20c96fd7f04930ef9e48d62c3d9432ec4df74627b491fcf2e02fcc93dafN.exe	93
PID 3196 wrote to memory of 3168	3196	Unicorn-35552.exe	95
PID 3196 wrote to memory of 3168	3196	Unicorn-35552.exe	95
PID 3196 wrote to memory of 3168	3196	Unicorn-35552.exe	95
PID 3028 wrote to memory of 4716	3028	Unicorn-15811.exe	96
PID 3028 wrote to memory of 4716	3028	Unicorn-15811.exe	96
PID 3028 wrote to memory of 4716	3028	Unicorn-15811.exe	96
PID 4716 wrote to memory of 4604	4716	Unicorn-64694.exe	97
PID 4716 wrote to memory of 4604	4716	Unicorn-64694.exe	97
PID 4716 wrote to memory of 4604	4716	Unicorn-64694.exe	97
PID 4084 wrote to memory of 2940	4084	Unicorn-2428.exe	98
PID 4084 wrote to memory of 2940	4084	Unicorn-2428.exe	98
PID 4084 wrote to memory of 2940	4084	Unicorn-2428.exe	98
PID 3028 wrote to memory of 3160	3028	Unicorn-15811.exe	99
PID 3028 wrote to memory of 3160	3028	Unicorn-15811.exe	99
PID 3028 wrote to memory of 3160	3028	Unicorn-15811.exe	99
PID 3168 wrote to memory of 4228	3168	Unicorn-12892.exe	100
PID 3168 wrote to memory of 4228	3168	Unicorn-12892.exe	100
PID 3168 wrote to memory of 4228	3168	Unicorn-12892.exe	100
PID 3196 wrote to memory of 2896	3196	Unicorn-35552.exe	101
PID 3196 wrote to memory of 2896	3196	Unicorn-35552.exe	101
PID 3196 wrote to memory of 2896	3196	Unicorn-35552.exe	101
PID 1616 wrote to memory of 376	1616	Unicorn-35276.exe	102
PID 1616 wrote to memory of 376	1616	Unicorn-35276.exe	102
PID 1616 wrote to memory of 376	1616	Unicorn-35276.exe	102
PID 1248 wrote to memory of 1940	1248	Unicorn-50636.exe	103

C:\Users\Admin\AppData\Local\Temp\d87df20c96fd7f04930ef9e48d62c3d9432ec4df74627b491fcf2e02fcc93dafN.exe
"C:\Users\Admin\AppData\Local\Temp\d87df20c96fd7f04930ef9e48d62c3d9432ec4df74627b491fcf2e02fcc93dafN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:232
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35552.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35552.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2428.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2428.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50636.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35276.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26447.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2472.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20690.exe
        8⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26630.exe
        9⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52550.exe
        10⤵
        
        PID:11244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54742.exe
        10⤵
        
        PID:14728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13954.exe
        10⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45485.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:12020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2402.exe
        9⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40884.exe
        8⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18754.exe
        8⤵
        
        PID:11076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55788.exe
        8⤵
        
        PID:15252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25490.exe
        7⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47980.exe
        8⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26630.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50355.exe
        9⤵
        
        PID:11428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56157.exe
        9⤵
        
        PID:15168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63533.exe
        9⤵
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48660.exe
        9⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33941.exe
        8⤵
        
        PID:8236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7923.exe
        8⤵
        
        PID:12672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48669.exe
        8⤵
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19371.exe
        8⤵
        
        PID:15512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7190.exe
        7⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2446.exe
        8⤵
        
        PID:10912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46605.exe
        8⤵
        
        PID:15004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38530.exe
        8⤵
        
        PID:15552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57702.exe
        7⤵
        
        PID:9896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40804.exe
        7⤵
        
        PID:12088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39596.exe
        7⤵
        
        PID:14816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43011.exe
        7⤵
        
        PID:3264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15471.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20690.exe
        7⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7278.exe
        8⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50355.exe
        8⤵
        
        PID:11448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52044.exe
        8⤵
        
        PID:16376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38746.exe
        7⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56829.exe
        7⤵
        
        PID:12324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19371.exe
        7⤵
        
        PID:15480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56823.exe
        6⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11467.exe
        7⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
        8⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59636.exe
        8⤵
        
        PID:13752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38629.exe
        8⤵
        
        PID:16196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46772.exe
        7⤵
        
        PID:9336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57245.exe
        7⤵
        
        PID:12992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47525.exe
        7⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9983.exe
        6⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
        7⤵
        
        PID:15256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58634.exe
        7⤵
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40589.exe
        6⤵
        
        PID:10208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24268.exe
        6⤵
        
        PID:14132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56699.exe
        6⤵
        
        PID:3652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62747.exe
        6⤵
        
        PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24370.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12747.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17292.exe
        7⤵
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47404.exe
        8⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20902.exe
        9⤵
        
        PID:8336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59030.exe
        9⤵
        
        PID:13700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61667.exe
        9⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30130.exe
        8⤵
        
        PID:9280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32988.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13954.exe
        8⤵
        
        PID:16884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54295.exe
        7⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32623.exe
        8⤵
        
        PID:10780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24565.exe
        8⤵
        
        PID:14800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54758.exe
        8⤵
        
        PID:548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32477.exe
        7⤵
        
        PID:10188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-617.exe
        7⤵
        
        PID:14948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18179.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28562.exe
        6⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27561.exe
        7⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        8⤵
        
        PID:11956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23514.exe
        8⤵
        
        PID:16700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47469.exe
        7⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20028.exe
        7⤵
        
        PID:14708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31532.exe
        7⤵
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20499.exe
        6⤵
        
        PID:3892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14044.exe
        6⤵
        
        PID:10636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15674.exe
        6⤵
        
        PID:6772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57271.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7634.exe
        6⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27206.exe
        7⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45677.exe
        7⤵
        
        PID:12028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48660.exe
        7⤵
        
        PID:14416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2067.exe
        6⤵
        
        PID:8312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20290.exe
        6⤵
        
        PID:12596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55695.exe
        6⤵
        
        PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32512.exe
        5⤵
        
        PID:1488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36652.exe
        6⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48371.exe
        7⤵
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37525.exe
        6⤵
        
        PID:9832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43028.exe
        6⤵
        
        PID:14080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31532.exe
        6⤵
        
        PID:13980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16902.exe
        5⤵
        
        PID:6992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44079.exe
        6⤵
        
        PID:12244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26690.exe
        6⤵
        
        PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43093.exe
        5⤵
        
        PID:9820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61718.exe
        5⤵
        
        PID:15124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43011.exe
        5⤵
        
        PID:3104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-527.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34194.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6603.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30473.exe
        7⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11467.exe
        8⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4974.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55350.exe
        9⤵
        
        PID:10868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64099.exe
        9⤵
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46772.exe
        8⤵
        
        PID:9360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37318.exe
        8⤵
        
        PID:12680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35084.exe
        8⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43325.exe
        8⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42546.exe
        7⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62415.exe
        8⤵
        
        PID:10700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24565.exe
        8⤵
        
        PID:14784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-738.exe
        8⤵
        
        PID:16172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44157.exe
        7⤵
        
        PID:10052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49469.exe
        7⤵
        
        PID:14188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19563.exe
        7⤵
        
        PID:15760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12911.exe
        6⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25833.exe
        7⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34863.exe
        8⤵
        
        PID:12356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5842.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20437.exe
        7⤵
        
        PID:10516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45213.exe
        7⤵
        
        PID:12948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32211.exe
        7⤵
        
        PID:15564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51444.exe
        6⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3403.exe
        7⤵
        
        PID:14116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60358.exe
        7⤵
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4418.exe
        6⤵
        
        PID:11408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12387.exe
        6⤵
        
        PID:14832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12693.exe
        6⤵
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37594.exe
        6⤵
        
        PID:16452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51127.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32777.exe
        6⤵
        
        PID:396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28329.exe
        7⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2446.exe
        8⤵
        
        PID:10936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39298.exe
        8⤵
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12876.exe
        7⤵
        
        PID:9684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5363.exe
        7⤵
        
        PID:14888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29762.exe
        7⤵
        
        PID:7232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40204.exe
        6⤵
        
        PID:7272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39727.exe
        7⤵
        
        PID:10552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31477.exe
        7⤵
        
        PID:14044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58634.exe
        7⤵
        
        PID:4156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64090.exe
        6⤵
        
        PID:11416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37900.exe
        6⤵
        
        PID:3652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3572.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4452
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 380
        7⤵
        Program crash
        
        PID:17804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41827.exe
        5⤵
        
        PID:5288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27206.exe
        6⤵
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        7⤵
        
        PID:9828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6101.exe
        7⤵
        
        PID:15084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32211.exe
        7⤵
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59981.exe
        6⤵
        
        PID:10656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28291.exe
        6⤵
        
        PID:14780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19371.exe
        6⤵
        
        PID:14476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18156.exe
        5⤵
        
        PID:8100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59091.exe
        5⤵
        
        PID:12060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8354.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18422.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-936.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34188.exe
        6⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4235.exe
        7⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51369.exe
        8⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39727.exe
        9⤵
        
        PID:10544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31477.exe
        9⤵
        
        PID:13980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5842.exe
        9⤵
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38101.exe
        8⤵
        
        PID:9872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41670.exe
        8⤵
        
        PID:14752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47578.exe
        8⤵
        
        PID:16300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7695.exe
        7⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32623.exe
        8⤵
        
        PID:10680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24565.exe
        8⤵
        
        PID:14764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39298.exe
        8⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26611.exe
        7⤵
        
        PID:9984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11228.exe
        7⤵
        
        PID:14880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7010.exe
        7⤵
        
        PID:15388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11474.exe
        6⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26255.exe
        7⤵
        
        PID:9812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35805.exe
        7⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44764.exe
        7⤵
        
        PID:5692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52861.exe
        6⤵
        
        PID:2140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
        6⤵
        
        PID:12376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34150.exe
        6⤵
        
        PID:1364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19371.exe
        6⤵
        
        PID:14348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53264.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15881.exe
        6⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37071.exe
        7⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20181.exe
        7⤵
        
        PID:11572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40733.exe
        7⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6661.exe
        7⤵
        
        PID:14904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20546.exe
        7⤵
        
        PID:1888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30220.exe
        6⤵
        
        PID:7756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58947.exe
        6⤵
        
        PID:14252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64143.exe
        6⤵
        
        PID:16548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe
        5⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2446.exe
        6⤵
        
        PID:10944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51276.exe
        6⤵
        
        PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33693.exe
        5⤵
        
        PID:8696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9155.exe
        5⤵
        
        PID:12984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7226.exe
        5⤵
        
        PID:5172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2015.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50732.exe
        5⤵
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10312.exe
        6⤵
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
        7⤵
        
        PID:7948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53082.exe
        7⤵
        
        PID:14284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56038.exe
        7⤵
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13049.exe
        7⤵
        
        PID:15764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53126.exe
        7⤵
        
        PID:17460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20812.exe
        6⤵
        
        PID:8272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19340.exe
        6⤵
        
        PID:11532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47578.exe
        6⤵
        
        PID:2760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44368.exe
        5⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
        6⤵
        
        PID:10036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46070.exe
        6⤵
        
        PID:13932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49364.exe
        6⤵
        
        PID:6596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64499.exe
        6⤵
        
        PID:728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63764.exe
        5⤵
        
        PID:9060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52102.exe
        5⤵
        
        PID:13192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49452.exe
        5⤵
        
        PID:16432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56327.exe
      4⤵
      PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28137.exe
        5⤵
        
        PID:6576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44717.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39298.exe
        6⤵
        
        PID:1840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12876.exe
        5⤵
        
        PID:10064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3417.exe
        5⤵
        
        PID:14940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7417.exe
        5⤵
        
        PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14869.exe
      4⤵
      PID:7252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61820.exe
      4⤵
      PID:11472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39211.exe
      4⤵
      PID:2904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13749.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13749.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36236.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44236.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46188.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63145.exe
        7⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47980.exe
        8⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16883.exe
        9⤵
        
        PID:8740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48262.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48684.exe
        9⤵
        
        PID:16488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61917.exe
        8⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8002.exe
        8⤵
        
        PID:13552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15627.exe
        8⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64176.exe
        7⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8709.exe
        8⤵
        
        PID:9672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29292.exe
        8⤵
        
        PID:13964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44764.exe
        8⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38900.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33004.exe
        7⤵
        
        PID:14732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19371.exe
        7⤵
        
        PID:15488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18386.exe
        6⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56806.exe
        7⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2620.exe
        7⤵
        
        PID:14168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38530.exe
        7⤵
        
        PID:15464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20956.exe
        6⤵
        
        PID:8116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18754.exe
        6⤵
        
        PID:11084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37205.exe
        6⤵
        
        PID:3936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6646.exe
        5⤵
        
        PID:1212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11848.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60070.exe
        7⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18860.exe
        7⤵
        
        PID:11300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61964.exe
        7⤵
        
        PID:16708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9717.exe
        6⤵
        
        PID:8172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53917.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7010.exe
        6⤵
        
        PID:14472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64160.exe
        5⤵
        
        PID:1388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
        6⤵
        
        PID:7900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51551.exe
        7⤵
        
        PID:17696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20181.exe
        6⤵
        
        PID:11604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47782.exe
        6⤵
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61434.exe
        6⤵
        
        PID:1268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42573.exe
        5⤵
        
        PID:8768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25484.exe
        5⤵
        
        PID:13016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44957.exe
        5⤵
        
        PID:14780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7349.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59369.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11915.exe
        6⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13003.exe
        7⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17414.exe
        8⤵
        
        PID:7796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27052.exe
        8⤵
        
        PID:12736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5756.exe
        8⤵
        
        PID:8532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11788.exe
        7⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5619.exe
        7⤵
        
        PID:13328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31810.exe
        7⤵
        
        PID:2780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59760.exe
        6⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24294.exe
        7⤵
        
        PID:9648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6101.exe
        7⤵
        
        PID:15016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36892.exe
        7⤵
        
        PID:1452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39462.exe
        6⤵
        
        PID:10460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42413.exe
        6⤵
        
        PID:13960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19563.exe
        6⤵
        
        PID:15684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36175.exe
        5⤵
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58889.exe
        6⤵
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39485.exe
        6⤵
        
        PID:11896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52070.exe
        6⤵
        
        PID:14496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47525.exe
        6⤵
        
        PID:18416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65149.exe
        5⤵
        
        PID:7408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65277.exe
        5⤵
        
        PID:11992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18897.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36218.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24655.exe
        5⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
        6⤵
        
        PID:7884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20181.exe
        6⤵
        
        PID:11728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26067.exe
        6⤵
        
        PID:15252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15531.exe
        6⤵
        
        PID:16212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2067.exe
        5⤵
        
        PID:8320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23965.exe
        5⤵
        
        PID:12084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52044.exe
        5⤵
        
        PID:16332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37987.exe
      4⤵
      PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56806.exe
        5⤵
        
        PID:8064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64691.exe
        5⤵
        
        PID:12240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36957.exe
        5⤵
        
        PID:212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14466.exe
        5⤵
        
        PID:6680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18156.exe
      4⤵
      PID:8108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31628.exe
      4⤵
      PID:12304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48346.exe
      4⤵
      PID:4388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12892.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12892.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10795.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14475.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32460.exe
        6⤵
        
        PID:452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25673.exe
        7⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
        8⤵
        
        PID:7940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55220.exe
        8⤵
        
        PID:14224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36683.exe
        8⤵
        
        PID:15104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25612.exe
        7⤵
        
        PID:7432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48468.exe
        7⤵
        
        PID:12440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13954.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7634.exe
        6⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7278.exe
        7⤵
        
        PID:7204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50355.exe
        7⤵
        
        PID:11456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21372.exe
        7⤵
        
        PID:15096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15531.exe
        7⤵
        
        PID:15536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11283.exe
        6⤵
        
        PID:7764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46653.exe
        6⤵
        
        PID:12744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44693.exe
        6⤵
        
        PID:14600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28757.exe
        6⤵
        
        PID:16560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40082.exe
        5⤵
        
        PID:2668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43945.exe
        6⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36614.exe
        7⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62927.exe
        8⤵
        
        PID:12928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56819.exe
        8⤵
        
        PID:16500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39477.exe
        7⤵
        
        PID:10440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43325.exe
        7⤵
        
        PID:16684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63085.exe
        6⤵
        
        PID:7788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19340.exe
        6⤵
        
        PID:12640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12693.exe
        6⤵
        
        PID:4860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47578.exe
        6⤵
        
        PID:15432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54234.exe
        5⤵
        
        PID:1088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
        6⤵
        
        PID:7868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20181.exe
        6⤵
        
        PID:11580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52044.exe
        6⤵
        
        PID:14728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41066.exe
        5⤵
        
        PID:9264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13653.exe
        5⤵
        
        PID:13076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35615.exe
        5⤵
        
        PID:13748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14906.exe
        5⤵
        
        PID:2436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17775.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50732.exe
        5⤵
        
        PID:4428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55756.exe
        6⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51430.exe
        7⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60150.exe
        7⤵
        
        PID:11368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58932.exe
        7⤵
        
        PID:14376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10001.exe
        7⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1077.exe
        6⤵
        
        PID:8248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53917.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48477.exe
        6⤵
        
        PID:400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12372.exe
        6⤵
        
        PID:7120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17554.exe
        5⤵
        
        PID:6564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30319.exe
        6⤵
        
        PID:10732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24565.exe
        6⤵
        
        PID:14776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14763.exe
        6⤵
        
        PID:16184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39462.exe
        5⤵
        
        PID:10476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42413.exe
        5⤵
        
        PID:14036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19371.exe
        5⤵
        
        PID:15496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56247.exe
      4⤵
      PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47980.exe
        5⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58991.exe
        6⤵
        
        PID:7264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34732.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63923.exe
        6⤵
        
        PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46772.exe
        5⤵
        
        PID:9352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57245.exe
        5⤵
        
        PID:13004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38530.exe
        5⤵
        
        PID:15452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35619.exe
      4⤵
      PID:6588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16614.exe
        5⤵
        
        PID:10772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24565.exe
        5⤵
        
        PID:14348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57766.exe
        5⤵
        
        PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55834.exe
        5⤵
        
        PID:912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49037.exe
      4⤵
      PID:9904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23692.exe
      4⤵
      PID:13888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53131.exe
      4⤵
      PID:16944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26182.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26182.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16588.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16809.exe
        5⤵
        
        PID:3464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42092.exe
        6⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48182.exe
        7⤵
        
        PID:9148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7228.exe
        7⤵
        
        PID:13708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7010.exe
        7⤵
        
        PID:15376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2716.exe
        6⤵
        
        PID:9092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1932.exe
        6⤵
        
        PID:12560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9489.exe
        6⤵
        
        PID:16860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31157.exe
        5⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60070.exe
        6⤵
        
        PID:7280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3813.exe
        7⤵
        
        PID:15032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37363.exe
        7⤵
        
        PID:1060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50355.exe
        6⤵
        
        PID:11392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23677.exe
        6⤵
        
        PID:15248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63533.exe
        6⤵
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48660.exe
        6⤵
        
        PID:6488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23452.exe
        5⤵
        
        PID:8184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18754.exe
        5⤵
        
        PID:12120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3572.exe
        5⤵
        
        PID:16236
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16236 -s 408
        6⤵
        Program crash
        
        PID:17844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35474.exe
      4⤵
      PID:404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19529.exe
        5⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64073.exe
        6⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44837.exe
        7⤵
        
        PID:920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38709.exe
        6⤵
        
        PID:11096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52044.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44694.exe
        5⤵
        
        PID:7608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38707.exe
        6⤵
        
        PID:4572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59412.exe
        5⤵
        
        PID:12044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36629.exe
        5⤵
        
        PID:15572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41850.exe
      4⤵
      PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13573.exe
        5⤵
        
        PID:7444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2636.exe
        5⤵
        
        PID:12536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32211.exe
        5⤵
        
        PID:14600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55613.exe
      4⤵
      PID:8792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
      4⤵
      PID:13576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18860.exe
      4⤵
      PID:13728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47578.exe
      4⤵
      PID:16280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8617.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8617.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58988.exe
      4⤵
      PID:1028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47404.exe
        5⤵
        
        PID:2284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16140.exe
        6⤵
        
        PID:10164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59805.exe
        6⤵
        
        PID:13688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27715.exe
        6⤵
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31532.exe
        6⤵
        
        PID:7004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65133.exe
        5⤵
        
        PID:9292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51380.exe
        5⤵
        
        PID:12756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22969.exe
        5⤵
        
        PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41202.exe
      4⤵
      PID:6660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62415.exe
        5⤵
        
        PID:10708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24565.exe
        5⤵
        
        PID:14444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58826.exe
        5⤵
        
        PID:15440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16284.exe
      4⤵
      PID:9744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33004.exe
      4⤵
      PID:14648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19371.exe
      4⤵
      PID:15516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37487.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37487.exe
    3⤵
    PID:4848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47980.exe
      4⤵
      PID:5744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
        5⤵
        
        PID:7892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20181.exe
        5⤵
        
        PID:11588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38629.exe
        5⤵
        
        PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31637.exe
      4⤵
      PID:9196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5619.exe
      4⤵
      PID:13320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48660.exe
      4⤵
      PID:17436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4920.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4920.exe
    3⤵
    PID:6696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30319.exe
      4⤵
      PID:10740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24565.exe
      4⤵
      PID:14744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37762.exe
      4⤵
      PID:1960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28036.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28036.exe
    3⤵
    PID:9880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13892.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13892.exe
    3⤵
    PID:13880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16317.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16317.exe
    3⤵
    PID:6164
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15811.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15811.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33615.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33615.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36236.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44428.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46188.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62953.exe
        7⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58889.exe
        8⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32623.exe
        9⤵
        
        PID:10756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24565.exe
        9⤵
        
        PID:14716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39298.exe
        9⤵
        
        PID:1468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48694.exe
        8⤵
        
        PID:10260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63988.exe
        8⤵
        
        PID:15140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36098.exe
        8⤵
        
        PID:15672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19701.exe
        7⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7603.exe
        7⤵
        
        PID:10492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3572.exe
        7⤵
        
        PID:16320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43762.exe
        6⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22223.exe
        7⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29868.exe
        7⤵
        
        PID:14164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35906.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11091.exe
        6⤵
        
        PID:7728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22236.exe
        6⤵
        
        PID:12464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54887.exe
        6⤵
        
        PID:3224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36437.exe
        6⤵
        
        PID:2848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44112.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43052.exe
        6⤵
        
        PID:684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44332.exe
        7⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30319.exe
        8⤵
        
        PID:10724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24565.exe
        8⤵
        
        PID:14480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19371.exe
        8⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32844.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51380.exe
        7⤵
        
        PID:12724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13954.exe
        7⤵
        
        PID:16928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55920.exe
        6⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21414.exe
        7⤵
        
        PID:10904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36957.exe
        7⤵
        
        PID:14216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55834.exe
        7⤵
        
        PID:1896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14556.exe
        6⤵
        
        PID:9244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31078.exe
        6⤵
        
        PID:14424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52044.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42298.exe
        5⤵
        
        PID:1724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27561.exe
        6⤵
        
        PID:2444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3733.exe
        6⤵
        
        PID:11188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3572.exe
        6⤵
        
        PID:16360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7013.exe
        5⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14309.exe
        6⤵
        
        PID:10612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3810.exe
        6⤵
        
        PID:5000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5379.exe
        5⤵
        
        PID:10624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6715.exe
        5⤵
        
        PID:15004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8354.exe
        5⤵
        
        PID:16816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65513.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9704.exe
        6⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51433.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
        8⤵
        
        PID:8012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28719.exe
        9⤵
        
        PID:13036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38899.exe
        9⤵
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55350.exe
        8⤵
        
        PID:10748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52032.exe
        8⤵
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31532.exe
        8⤵
        
        PID:7632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30220.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16371.exe
        7⤵
        
        PID:12528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48669.exe
        7⤵
        
        PID:14756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52812.exe
        7⤵
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33586.exe
        6⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
        7⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-690.exe
        7⤵
        
        PID:12652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53219.exe
        7⤵
        
        PID:4860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9628.exe
        6⤵
        
        PID:8552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55293.exe
        6⤵
        
        PID:12616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29717.exe
        6⤵
        
        PID:15096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25490.exe
        5⤵
        
        PID:3520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47980.exe
        6⤵
        
        PID:8
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        7⤵
        
        PID:10096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55219.exe
        7⤵
        
        PID:14916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37660.exe
        7⤵
        
        PID:7492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5644.exe
        6⤵
        
        PID:8724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7228.exe
        6⤵
        
        PID:13692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56419.exe
        6⤵
        
        PID:17316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54938.exe
        5⤵
        
        PID:6668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46191.exe
        6⤵
        
        PID:12168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55165.exe
        6⤵
        
        PID:16400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57126.exe
        5⤵
        
        PID:9840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40228.exe
        5⤵
        
        PID:13984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4340.exe
        5⤵
        
        PID:4332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44666.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50732.exe
        5⤵
        
        PID:3884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36073.exe
        6⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
        7⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55350.exe
        7⤵
        
        PID:12224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13954.exe
        7⤵
        
        PID:16892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46772.exe
        6⤵
        
        PID:9344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58634.exe
        7⤵
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57245.exe
        6⤵
        
        PID:13136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35084.exe
        6⤵
        
        PID:14728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52044.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30735.exe
        5⤵
        
        PID:6500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13006.exe
        6⤵
        
        PID:9480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5525.exe
        6⤵
        
        PID:14972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40732.exe
        6⤵
        
        PID:1324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36020.exe
        5⤵
        
        PID:9760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33004.exe
        5⤵
        
        PID:14504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52044.exe
        5⤵
        
        PID:16352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48163.exe
      4⤵
      PID:680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11467.exe
        5⤵
        
        PID:6412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53967.exe
        6⤵
        
        PID:11820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64499.exe
        6⤵
        
        PID:3416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22284.exe
        5⤵
        
        PID:9752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43604.exe
        5⤵
        
        PID:14208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19371.exe
        5⤵
        
        PID:2212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16969.exe
      4⤵
      PID:7088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56902.exe
        5⤵
        
        PID:9528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58634.exe
        5⤵
        
        PID:3700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24053.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57535.exe
      4⤵
      PID:13748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33403.exe
      4⤵
      PID:14776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13963.exe
      4⤵
      PID:4024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64694.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64694.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56841.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42057.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62828.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56041.exe
        7⤵
        
        PID:464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47980.exe
        8⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56806.exe
        9⤵
        
        PID:8036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59636.exe
        9⤵
        
        PID:13772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48660.exe
        9⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18508.exe
        8⤵
        
        PID:8828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62470.exe
        9⤵
        
        PID:11268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64499.exe
        9⤵
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11187.exe
        8⤵
        
        PID:12900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65059.exe
        8⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58992.exe
        7⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13198.exe
        8⤵
        
        PID:9448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6101.exe
        8⤵
        
        PID:15008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44764.exe
        8⤵
        
        PID:15544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56125.exe
        7⤵
        
        PID:10332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28515.exe
        7⤵
        
        PID:15188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23499.exe
        7⤵
        
        PID:3680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11474.exe
        6⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30694.exe
        7⤵
        
        PID:8812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22636.exe
        7⤵
        
        PID:13480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23545.exe
        7⤵
        
        PID:1180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43956.exe
        6⤵
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52996.exe
        6⤵
        
        PID:14300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50292.exe
        6⤵
        
        PID:316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62646.exe
        5⤵
        
        PID:3580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42092.exe
        6⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37071.exe
        7⤵
        
        PID:7856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4530.exe
        7⤵
        
        PID:11556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38722.exe
        7⤵
        
        PID:9924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22259.exe
        6⤵
        
        PID:9076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17820.exe
        6⤵
        
        PID:12976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3572.exe
        6⤵
        
        PID:16344
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16344 -s 388
        7⤵
        Program crash
        
        PID:17828
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16344 -s 388
        7⤵
        Program crash
        
        PID:17856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19833.exe
        5⤵
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
        6⤵
        
        PID:7292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37228.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44764.exe
        6⤵
        
        PID:14456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40413.exe
        5⤵
        
        PID:8264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11625.exe
        5⤵
        
        PID:12568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2545.exe
        5⤵
        
        PID:15696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28818.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62828.exe
        5⤵
        Executes dropped EXE
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42092.exe
        6⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37071.exe
        7⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60726.exe
        7⤵
        
        PID:11484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23170.exe
        7⤵
        
        PID:2864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7221.exe
        6⤵
        
        PID:8144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12889.exe
        6⤵
        
        PID:12116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19371.exe
        6⤵
        
        PID:15524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37618.exe
        5⤵
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
        6⤵
        
        PID:8004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55350.exe
        6⤵
        
        PID:12256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48660.exe
        6⤵
        
        PID:17428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2245.exe
        5⤵
        
        PID:9156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
        5⤵
        
        PID:13584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27153.exe
        5⤵
        
        PID:7428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49210.exe
      4⤵
      PID:2356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63628.exe
        5⤵
        
        PID:5572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2510.exe
        6⤵
        
        PID:8388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59798.exe
        6⤵
        
        PID:13892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40791.exe
        6⤵
        
        PID:1480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64691.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30220.exe
        5⤵
        
        PID:7620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19340.exe
        5⤵
        
        PID:12956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62171.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11583.exe
      4⤵
      PID:5952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11886.exe
        5⤵
        
        PID:2028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53967.exe
        6⤵
        
        PID:11812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4654.exe
        6⤵
        
        PID:7076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29036.exe
        5⤵
        
        PID:10572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54758.exe
        5⤵
        
        PID:9184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50061.exe
      4⤵
      PID:7392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62573.exe
      4⤵
      PID:12500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40228.exe
      4⤵
      PID:14716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
      4⤵
      PID:8280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16476.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16476.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1704.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56876.exe
        5⤵
        
        PID:4476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63628.exe
        6⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16883.exe
        7⤵
        
        PID:8748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47494.exe
        7⤵
        
        PID:13612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36629.exe
        7⤵
        
        PID:1560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24755.exe
        6⤵
        
        PID:8520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25190.exe
        6⤵
        
        PID:13348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43249.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57520.exe
        5⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37071.exe
        6⤵
        
        PID:8044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59636.exe
        6⤵
        
        PID:13788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31618.exe
        6⤵
        
        PID:16516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27827.exe
        5⤵
        
        PID:8704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12444.exe
        5⤵
        
        PID:12824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16395.exe
        5⤵
        
        PID:15680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25490.exe
      4⤵
      PID:1476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47980.exe
        5⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8709.exe
        6⤵
        
        PID:9664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29292.exe
        6⤵
        
        PID:14296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23545.exe
        6⤵
        
        PID:15424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32844.exe
        5⤵
        
        PID:9372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51380.exe
        5⤵
        
        PID:11160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31532.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40439.exe
      4⤵
      PID:6728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46070.exe
        5⤵
        
        PID:14260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36674.exe
        5⤵
        
        PID:6340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41885.exe
      4⤵
      PID:9720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40804.exe
      4⤵
      PID:14148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24075.exe
      4⤵
      PID:8260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18626.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18626.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24972.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15881.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        6⤵
        
        PID:10120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55219.exe
        6⤵
        
        PID:14924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48371.exe
        6⤵
        
        PID:5252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30220.exe
        5⤵
        
        PID:7664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58947.exe
        5⤵
        
        PID:14236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55788.exe
        5⤵
        
        PID:15504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20054.exe
      4⤵
      PID:6156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
        5⤵
        
        PID:10012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46070.exe
        5⤵
        
        PID:12952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49364.exe
        5⤵
        
        PID:15060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32211.exe
        5⤵
        
        PID:14904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49731.exe
      4⤵
      PID:9300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30188.exe
      4⤵
      PID:13148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18549.exe
      4⤵
      PID:3456
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3456 -s 80
        5⤵
        Program crash
        
        PID:9104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15051.exe
      4⤵
      PID:16468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14505.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14505.exe
    3⤵
    PID:2264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44713.exe
      4⤵
      PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        5⤵
        
        PID:9488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55219.exe
        5⤵
        
        PID:14908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7867.exe
        5⤵
        
        PID:15168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14092.exe
      4⤵
      PID:8688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6579.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48660.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:17452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38767.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38767.exe
    3⤵
    PID:5388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4974.exe
      4⤵
      PID:8052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59636.exe
      4⤵
      PID:13804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12459.exe
      4⤵
      PID:5008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29974.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29974.exe
    3⤵
    PID:8808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51195.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51195.exe
    3⤵
    PID:13048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63819.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63819.exe
    3⤵
    PID:3008
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27484.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27484.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20393.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20393.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39378.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23049.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49004.exe
        6⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10539.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8371.exe
        7⤵
        
        PID:11272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55788.exe
        7⤵
        
        PID:1704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53142.exe
        6⤵
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46150.exe
        7⤵
        
        PID:12876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17356.exe
        7⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57866.exe
        7⤵
        
        PID:468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2035.exe
        6⤵
        
        PID:11796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52070.exe
        6⤵
        
        PID:3328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4666.exe
        6⤵
        
        PID:16124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22226.exe
        5⤵
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7470.exe
        6⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32211.exe
        7⤵
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50355.exe
        6⤵
        
        PID:11436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15187.exe
        6⤵
        
        PID:14480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64780.exe
        6⤵
        
        PID:1364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20956.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18754.exe
        5⤵
        
        PID:12180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1228.exe
        5⤵
        
        PID:15356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24075.exe
        5⤵
        
        PID:4184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50167.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63721.exe
        5⤵
        
        PID:3904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11467.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
        7⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30245.exe
        8⤵
        
        PID:892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20181.exe
        7⤵
        
        PID:11596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37762.exe
        7⤵
        
        PID:15788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31637.exe
        6⤵
        
        PID:8796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9459.exe
        6⤵
        
        PID:13060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31042.exe
        6⤵
        
        PID:1264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9682.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30319.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58774.exe
        6⤵
        
        PID:14496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55834.exe
        6⤵
        
        PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39462.exe
        5⤵
        
        PID:10468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42413.exe
        5⤵
        
        PID:12752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39490.exe
        5⤵
        
        PID:2248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42595.exe
      4⤵
      PID:5392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1845.exe
        5⤵
        
        PID:8344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8485.exe
        5⤵
        
        PID:14196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10001.exe
        5⤵
        
        PID:6736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35945.exe
      4⤵
      PID:8176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59091.exe
      4⤵
      PID:11292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11204.exe
      4⤵
      PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8354.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22066.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22066.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1512.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18921.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42092.exe
        6⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2446.exe
        7⤵
        
        PID:10928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64099.exe
        7⤵
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25010.exe
        6⤵
        
        PID:8188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65501.exe
        6⤵
        
        PID:13760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48108.exe
        6⤵
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48371.exe
        5⤵
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16883.exe
        6⤵
        
        PID:8732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47494.exe
        6⤵
        
        PID:13596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3572.exe
        6⤵
        
        PID:15416
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15416 -s 384
        7⤵
        Program crash
        
        PID:17812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53053.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17116.exe
        6⤵
        
        PID:1996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17986.exe
        5⤵
        
        PID:11928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6286.exe
        5⤵
        
        PID:6648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3570.exe
      4⤵
      PID:1756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63628.exe
        5⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
        6⤵
        
        PID:8072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59636.exe
        6⤵
        
        PID:13796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45131.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39125.exe
        5⤵
        
        PID:7356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48468.exe
        5⤵
        
        PID:12404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55258.exe
        5⤵
        
        PID:9100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20793.exe
      4⤵
      PID:5892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7278.exe
        5⤵
        
        PID:7324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32623.exe
        6⤵
        
        PID:10660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44301.exe
        6⤵
        
        PID:14412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31020.exe
        6⤵
        
        PID:16796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50355.exe
        5⤵
        
        PID:11464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35084.exe
        5⤵
        
        PID:14476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54758.exe
        5⤵
        
        PID:2700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54118.exe
      4⤵
      PID:8292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46628.exe
      4⤵
      PID:12624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1969.exe
      4⤵
      PID:888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31510.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31510.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25548.exe
      4⤵
      PID:3380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9736.exe
        5⤵
        
        PID:6132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4206.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10419.exe
        6⤵
        
        PID:13120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64972.exe
        6⤵
        
        PID:6972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61430.exe
        5⤵
        
        PID:8544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14425.exe
        5⤵
        
        PID:12584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64099.exe
        5⤵
        
        PID:17116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44560.exe
      4⤵
      PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
        5⤵
        
        PID:7932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53082.exe
        5⤵
        
        PID:14264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56230.exe
        5⤵
        
        PID:14728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55066.exe
        5⤵
        
        PID:1968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32243.exe
      4⤵
      PID:8836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48381.exe
      4⤵
      PID:13100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40236.exe
      4⤵
      PID:14496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48739.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48739.exe
    3⤵
    PID:3888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11467.exe
      4⤵
      PID:6460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45871.exe
        5⤵
        
        PID:10148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59469.exe
        5⤵
        
        PID:14824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10939.exe
        5⤵
        
        PID:5332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50260.exe
      4⤵
      PID:10340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37181.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37181.exe
      4⤵
      PID:15180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43325.exe
      4⤵
      PID:6740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1318.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1318.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53967.exe
      4⤵
      PID:11832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47714.exe
      4⤵
      PID:7108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60758.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60758.exe
    3⤵
    PID:9260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10197.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10197.exe
    3⤵
    PID:14472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39298.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39298.exe
    3⤵
    PID:16672
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35971.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35971.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12139.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12139.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41772.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12491.exe
        5⤵
        
        PID:2428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11467.exe
        6⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
        7⤵
        
        PID:10020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11477.exe
        7⤵
        
        PID:14416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28994.exe
        7⤵
        
        PID:628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30130.exe
        6⤵
        
        PID:9272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32988.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3042.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6034.exe
        5⤵
        
        PID:7080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2446.exe
        6⤵
        
        PID:10920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64867.exe
        6⤵
        
        PID:796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43389.exe
        5⤵
        
        PID:10192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31078.exe
        5⤵
        
        PID:14448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52044.exe
        5⤵
        
        PID:16248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2735.exe
      4⤵
      PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41676.exe
        5⤵
        
        PID:6240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57869.exe
        5⤵
        
        PID:11068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59812.exe
        5⤵
        
        PID:11140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44898.exe
        5⤵
        
        PID:16716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65149.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65085.exe
      4⤵
      PID:11976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47578.exe
      4⤵
      PID:16260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22482.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22482.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45932.exe
      4⤵
      PID:3940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52108.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51430.exe
        6⤵
        
        PID:7636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28053.exe
        6⤵
        
        PID:11252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58932.exe
        6⤵
        
        PID:1620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7010.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62317.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53917.exe
        5⤵
        
        PID:12704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13227.exe
        5⤵
        
        PID:16220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31503.exe
      4⤵
      PID:6520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6862.exe
        5⤵
        
        PID:10580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49075.exe
        5⤵
        
        PID:14056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58634.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38900.exe
      4⤵
      PID:9932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29734.exe
      4⤵
      PID:14084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56132.exe
      4⤵
      PID:14752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42612.exe
      4⤵
      PID:16532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49335.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49335.exe
    3⤵
    PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61001.exe
      4⤵
      PID:6988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26159.exe
        5⤵
        
        PID:14788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58634.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48694.exe
      4⤵
      PID:9660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63988.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13954.exe
      4⤵
      PID:16908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26941.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26941.exe
    3⤵
    PID:7296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21414.exe
      4⤵
      PID:10952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39298.exe
      4⤵
      PID:4308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56420.exe
    3⤵
    PID:12036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42243.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42243.exe
    3⤵
    PID:16272
- C:\Users\Admin\AppData\Local\Temp\Unicorn-329.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-329.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63401.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63401.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52268.exe
      4⤵
      PID:1536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23084.exe
        5⤵
        
        PID:6128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18182.exe
        6⤵
        
        PID:7824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59636.exe
        6⤵
        
        PID:13780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39490.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51565.exe
        5⤵
        
        PID:8900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47581.exe
        5⤵
        
        PID:13140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23362.exe
        5⤵
        
        PID:16416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64368.exe
      4⤵
      PID:6552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16614.exe
        5⤵
        
        PID:11012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54742.exe
        5⤵
        
        PID:14376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3042.exe
        5⤵
        
        PID:16292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51837.exe
      4⤵
      PID:9912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48893.exe
      4⤵
      PID:14072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7010.exe
      4⤵
      PID:15444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23865.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23865.exe
    3⤵
    PID:5228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
      4⤵
      PID:7956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53082.exe
      4⤵
      PID:14272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36683.exe
      4⤵
      PID:4108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35037.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35037.exe
    3⤵
    PID:8524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13571.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13571.exe
    3⤵
    PID:12488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4154.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4154.exe
    3⤵
    PID:16692
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38511.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38511.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30473.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30473.exe
    3⤵
    PID:4348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1675.exe
      4⤵
      PID:6480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50260.exe
      4⤵
      PID:10352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37181.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37181.exe
      4⤵
      PID:15172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38530.exe
      4⤵
      PID:14692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41135.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41135.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62429.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62429.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:10248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4316.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4316.exe
    3⤵
    PID:15132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52044.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52044.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:16308
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24376.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24376.exe
  2⤵
  PID:2464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8811.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8811.exe
    3⤵
    PID:5940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22831.exe
      4⤵
      PID:11720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4597.exe
      4⤵
      PID:13728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64499.exe
      4⤵
      PID:3308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48694.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48694.exe
    3⤵
    PID:10172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63988.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63988.exe
    3⤵
    PID:15116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13954.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13954.exe
    3⤵
    PID:16900
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41348.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41348.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21414.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21414.exe
    3⤵
    PID:10872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59712.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59712.exe
    3⤵
    PID:3836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52762.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52762.exe
    3⤵
    PID:16160
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12653.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12653.exe
  2⤵
  PID:11424
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36411.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36411.exe
  2⤵
  PID:612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 12992 -ip 12992
1⤵
PID:14120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 13748 -ip 13748
1⤵
PID:14464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3456 -ip 3456
1⤵
PID:9172

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 16344 -ip 16344
1⤵
PID:1316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4452 -ip 4452
1⤵
PID:1176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 16236 -ip 16236
1⤵
PID:6436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 15416 -ip 15416
1⤵
PID:3488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 16360 -ip 16360
1⤵
PID:17412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 16320 -ip 16320
1⤵
PID:17516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10795.exe

Filesize
468KB

MD5
cc91d9657fc8ca4a9c367b07f75e57bf

SHA1
363fcdc0c911ffc8b11324e26ba3a4892261a533

SHA256
b08c600e08a17a423395a868afecbda62788346ea4fd2d2fd0e52f8ff7df111b

SHA512
3865be4f6f18efef29932753375eacd14877a9458f204ea6dd1360dc4570c3ab8412fa11bd2f932c0ecf73dbe09aecf320badf70a528cec5865138e9344c6049

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12139.exe

Filesize
468KB

MD5
116c3ee0d6eb84348de0f2fe1d767ede

SHA1
b4ee0b54b0cd234c1a1343956b1c7b133c601057

SHA256
7c78106ebdbd6b392f370667cc78f32d9461c8e0df1ff9bf66f8095f78cb4263

SHA512
15cabac2036d525ce83e64769916430bc49697b8634a712595f1c6e597226484e6477ff944b314bb41a3006ab95b7edbac3284366e615e45e800e99136dbfe87

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12892.exe

Filesize
468KB

MD5
54e17f563d8be291cac56c2b714eb558

SHA1
406bcb394edb9f7f58fae7bd3d2f3d2018eede3f

SHA256
350d7eec68e610be4a788371a5dba7ca2aedddd5f2d874a5c30dedea33c2fbcd

SHA512
be7c8a8ff43d39570ed51a3e62a57810af5356f77a628fcf1a51ebce2016baa3d86bb8b61208eacb31db4633d62617e87a5a1f8372fcc9be3b3e3c239b1cc5e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13749.exe

Filesize
468KB

MD5
7baef316a6a4b9eb22d9c1ac749a0805

SHA1
c5c42954d5be86571b0edc81bc702e4fcf14fd4a

SHA256
d0ed416c88437f2edaac5758dddf0a5da042b6f491f4d699cbfbf3d7f5171b30

SHA512
733a3cb2296bc1bed8368c92148c4bd210d834cb925b1a934764e0cedd6ac4c26a81fbbc46b11ae7dbbc860b9f6095dffaccb97752aab201737a40d3370cecb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15811.exe

Filesize
468KB

MD5
adb67b0978a2c4b52db01723c342c437

SHA1
31721dfd8c69c1894fc813c1765dde54f29515b5

SHA256
29cdd80050e3ce2bd6b4de0e1dfb442b130ee8be3ae06686a85b2b1c3ba4e242

SHA512
1d825f934f3aebe944eed28fbf532b7f78847eda910d329cb4a89d4b3426d0a0805da50c20336055530c3d41f39e12e57a2523a88d1a4394f0964a430aaed2dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16476.exe

Filesize
468KB

MD5
c39601a0942a7e7029fcebc22a70d5d3

SHA1
338a94165ba7ff6b01088face57d0058768ec554

SHA256
a20bb11836024b48f38f596c8a55fba0951d6d79671a2ef2a8c8130c23b635bb

SHA512
5b435beb71e812a383ce91a8e6d4686281771b6b964d4ba4d9687aa8678e4a1497572a146aa8823c8fa668087e9bf2a701804bb8d7ac92a10f330fe1d6071911

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18422.exe

Filesize
468KB

MD5
5837f8396baef46e53cb9047ce6c636d

SHA1
946df548f6880022d2ef5f7b9d5d85788b2f7c7b

SHA256
0a383f9806cebe0bb918454abc0ce01dc07c576084f1546b0e81979199e6b602

SHA512
26b46fb5c78117302d984a11dde615625e590417c05a8c6e419c73166152643bf675a28de2ed25cc2c2a959771dccf5af52b1bc6f6561f4de2c75ca8acc93cf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20393.exe

Filesize
468KB

MD5
2612bd77c9dfab5125d80efe3b60f491

SHA1
95edee0ad386a77294b052570a03f244b822057a

SHA256
8f8aa19fdddb29e5a22cb555ff256a419a277da2ce72db9115265b91b6c0cb9a

SHA512
952470e6fe7877dc86c31216601a5c9f0e890dbcabe6eec02d54d6536445d09979d1eedbb66f4d530b6fe5d0108e84de591d9b7023e46f1e1c14375e38cbbea5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22066.exe

Filesize
468KB

MD5
3a9463e0d68b847903f7653fef7cc903

SHA1
c360b87848b2720a00a71e7a06398d1f1281e18b

SHA256
49ad4e26e76a0e346c8abf9facd6d6fb9be5e5148b0b85e9c183e1093c588168

SHA512
fb35b5bdfa98552c214766b521110bb7a92ce0c8189407c8e6c50cd6eb6fa29ac196e245d35da23f6ac3c607507ae79c3ebd3a75ef3df7ac040ec2f7e6887c14

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2428.exe

Filesize
468KB

MD5
a3d1fc3f3912101affdad8e35aa0e0cb

SHA1
3280c56791d6fa8581ef893d6d4c5132a189a115

SHA256
26c899e8b0cf5f205a983e477bde765db39800abee1e429959fb9105a7dc8f5a

SHA512
08b3c43650cc5104b10efc4b708542c256216ccdc5d6d27de433164cab8df0556dd0c1e19612528564ae99a82547e17e7d4c4b9177267433348a493c591036ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24370.exe

Filesize
468KB

MD5
469152eefad8c0737ecdd19df3dddc2d

SHA1
a161417838c454c1a69d245dc975adaf561a69d4

SHA256
74b0fb3dab6c9db05808de5163976bbba493e56ca90142bbb83140b9e4fcb9d6

SHA512
6e88f48501152700c5b27cadb4aab5d0d0c4e53f97754272edcecf73b755a03969cc443863709ca54cda0ada07d1bbc982768b937463803bce98ac9f7c2a870c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26182.exe

Filesize
468KB

MD5
ae1f0124bc3a92faab293bf52f60720a

SHA1
eb3ddf35a692e14c57b1d9fbf61cc3958fe85073

SHA256
d24bb7322d7ea48ccc6ff96f704c561c4e473d929d15c3c213dd5b06ce31287d

SHA512
9c55d0526a88d374245c75d3c99bde564b7ea8913cd50424b73cdfab47e604a65918256bdaaa4d49e278a6e9398c521d18577905c25dace2fb8aa861da38c6eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26447.exe

Filesize
468KB

MD5
15f1b431fecbe6d33b76f9def7742c79

SHA1
07a49add201c581534118eddee3329e7962d08c2

SHA256
d4387e09fdc9fca9fdb3e38e01251a2bdfc5396c324cef6ef706674c8a184f3f

SHA512
f870cb3497cf055ce7a90c14a3f3a13dec96d8abc0a11d614fd00b987d7c34d0d07199d2b5220a35b70a02bc56d3cad5de4500d65240c958b1f7a558193e53dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27484.exe

Filesize
468KB

MD5
ba040ae8e67913953559e3bee9f4f47b

SHA1
d273eb6ed629dde6bdd7c7dbca38f61967fecb15

SHA256
e1d9af643f4cbd12287013ee34478894306af33f5f7af23aa4288d8439211cb7

SHA512
1f8146a34894c8e9410059462282293e6f2b0ea494e3fe83fc1c6fc5c25536360a08f71f65d69bef53ea664b009534693936336fd613b5aeccf181c2ff1bcb06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-329.exe

Filesize
468KB

MD5
bc136cf1ee9fd313d8a55ed4e8b6bd14

SHA1
2252d089019b1c89bb75efa9c1fa92e8f78a3ad8

SHA256
fb29e8538008a18de27290e62f7de9eb6db5b07357ecd7257d7e299fca33fe68

SHA512
f50efe528f98959bab72e24796c725d5b0e09e303a27e8507b52229da3e335c46812a006d80e486438103628060e85994a9daad8fa90b0f75582918fc6ba3360

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33615.exe

Filesize
468KB

MD5
51f79fcc6819968e803b5ff00f04c04f

SHA1
3fcea3f91de2a6c8a8a5fba8ba64f4a4356815cd

SHA256
86c1047e157929fbecfcd08743c6c722d39ee92862681bc14f757d1499c96614

SHA512
5d23c5eab8daecdea0dd711736efd06e2a12da3934ddb342b62f0148db645603a002e409d64590eb375ba626c76943b2e994d4a28db7a054fbb466e035a5aeef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34194.exe

Filesize
468KB

MD5
9182450f3453a0586d5fae8a110a1b18

SHA1
7af54392bbb1efb7cc018d45a6ad2c1f40432265

SHA256
92b761b449d5ba6467ad0636c5544c2a0a15ccb96ce3e7baa3248831556cbfcd

SHA512
9051dc799f1c0afd6cfc4083a4a50c978be3808ee1c870cd641813e0111b5cc6b91d1b5d5f8dc0c300fb7b093b47853e9223ec7db18f5ec961395ef7eafca673

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35276.exe

Filesize
468KB

MD5
323ba04a1042b8c63651bd1ece62891a

SHA1
2ea0489449325673d616a6a16006ee4187776fe8

SHA256
9310a4a11bce733be8e7b2cd04f98a45d8d02305e45aa7a554fd0b55d343059c

SHA512
53b694d1b444147904444b371981dbbfef07a1621cb4150cbe8487aa472038f6beed67dfccfec49265bf822bebda27303d94408c8c2ed237c78b072d86ba8569

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35552.exe

Filesize
468KB

MD5
f624e67093ee6d051810e0acf2fb951a

SHA1
329d75c538af77903845aa8fdcecb4e310313dc9

SHA256
adc220653e939e5220666ce9ab58def960a5281f5ac369f643039451fc3bc2fe

SHA512
f6f2803718b4bc915217dc107b6f0e2d50fc0ae903acbe5cbc8c59db6532c44efa884301c27b60d37d6d5f60aba819798a3cba6717d150ab522b9995cf614fa1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35971.exe

Filesize
468KB

MD5
76e5541d5ca83e35f74052bc3988b29f

SHA1
37f792864ca9f9391e2a0191a29480431fb65800

SHA256
e667bab18df109474b1e4ff8bcc41bd043130372b2f2734324819219428dff33

SHA512
a0e41008cff697ce442d4deb743dccd0087db90af78ccb740b1872f704adcf5a92fbe2d533b38767ec1a13666ab775507284f25390a7c657d17a4cfe21d0ec99

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36236.exe

Filesize
468KB

MD5
acb9665d48ed7343bebcdef5cb86237b

SHA1
4c272610e16ce89c24ea81ef0c9f505459ef599b

SHA256
951edcfa8035485c03139d4e41ffca15230639577e23b54b7fd033caedb03cdb

SHA512
bbbd726470977960689a56561646c30c9f5f8891415101ec40675e1bda8cabad81b78097a1a8cf1dde5daf44dc62830e8ccb4d7f92e96fba7aaaa338fa29be14

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36614.exe

Filesize
468KB

MD5
31e06fae467f7ca19b155360cd67d930

SHA1
cb6b8f71accd1ef36c9c6420efbc24863188b86e

SHA256
39071c8e374308ce970500f2adc8a243381f70619bf210ed817d0092f3e94032

SHA512
99cd1d1cf64be7226a087eede6edb2b4c66c1b3939f669da0e625da176a2995e561bb446049a20a675b576869e4a4b114e67e4729cdbf7e6db0134a3dd921783

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39378.exe

Filesize
468KB

MD5
dea39620f5673bb60d3aa122b568440f

SHA1
31c837ad4cc133af6633d55cb7823b6580de382e

SHA256
07052fb458d501589c514867d96387494c34b780e85b880e3b136a09cd09be0d

SHA512
2e200ea40005fe1995a56a3acd6e7c5dbae31e9493ae36cb1370712592d7d1e77e8ee02d1b2856149f63205062abdc37c0bb3bd5b56696251837fd0c35ce872d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42057.exe

Filesize
468KB

MD5
04af4abb026d73133af644d0c83155d2

SHA1
fc80d1a26f341608614faa3f4726859c91ab11f5

SHA256
928ce42b24cf18d803e16889a709e2790d19c718f4bd83626f9934e96c122320

SHA512
f987b57123358ab416e1a944a4482deba5edb62b170b23467c1695ef5ade000d5de2b734d020e0a3249785a5ca915c292a1265610213a1dd747d894b2ab43625

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44236.exe

Filesize
468KB

MD5
d870fa775fdd45fe1eb2e86bbf5f8b49

SHA1
c6379180a6ab23867a49547cd9971571020dcb95

SHA256
766adff0ac7b3d13f350dfbca3e8f4e9bc1f88b0dc9db97bc188247a1a1ad8f1

SHA512
a29766636a919273369335e59984e2252b3b62b3a717fdd22bfeb87e15b4de7697ffe4b70ce65d5eaf2e2c35cd7a2cfffd740c11037da3944ad95ba0624039ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44428.exe

Filesize
468KB

MD5
7d04f657beaa47db840fadff128ed550

SHA1
603e1094cd61a80a2b6a375e08fda9b6b68e8798

SHA256
8db14d8e53bda5a32b1b4a457705af672f10d1cde0ac155894319d24c72651d1

SHA512
5af020227db476156897b68578705c08380ca2785ca79dc235747221b20b2ffc7c7898baf4166f03c5e4f2a0d47c323418b7fabaf774fc721a3e80bcd38ec271

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50636.exe

Filesize
468KB

MD5
85eab60fa82d161cf6ed7bac0dec40f3

SHA1
b3f90d77e168bec902ce7391b0346695719e9663

SHA256
b91afbd42f5eaf429bb43a35f30cd98e9536a5b9530e78700914a9e0fe6481f9

SHA512
68218f42b9baf161fbf236b577c0fbaa8df3cb1644a636dfde227ae46007bd3c046d8ca101400db2bb03e9fb317de8a20888b958f88bf03d65829357bff385cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-527.exe

Filesize
468KB

MD5
4c4ef3e4e0a823efd4725c6dc03b69be

SHA1
858f5fa5f59207f12fa2660eee67d612242a3e97

SHA256
d20326c008872440254c219ea2953cead716a04f2e3d0ad4eae108ec0cec066f

SHA512
1e3aea7d7de4d382275e12d276784937b6e99373f04be4f233c0734ff8acc842cf379b9b87736a04db6c84d625db64779cf0c81481253d769e713667316ed3d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe

Filesize
468KB

MD5
72fd7071b9c78286c4c97321e0829008

SHA1
40e18b4c0113584b2fe063a6cce7f279bfcaa1b1

SHA256
fc35b4ede24d461a1c247e99b5c7eb6229ee66d427f3c5f8de7d9c068d993673

SHA512
1076daac8fd46c1c0bddbf322fa776743171203cd8f5ad1d17ceb4ca9dfe4276423789a33006e7de6c2dfec96ce641a961d77fdea19cbba201e4ab7b2b249808

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56841.exe

Filesize
468KB

MD5
897e3b08728704adca2845fb6ba4b23e

SHA1
5218641661249ef1d89f521b339a19897059aec9

SHA256
d4497fb5d205b1cfa50fd858045c917f6932753a19af0d1016432d9e65120d8e

SHA512
ccd3b50a726e82c51aea64a6ce6d61c025d776b22a1d14db2820a051ed55662ce1dadd3612a2369926ef2b0d33328e4b304b61fa85ac0e5e6ae92a002eabd899

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64694.exe

Filesize
468KB

MD5
167666f394d5f616f84e551bed0a64d7

SHA1
9f0ac801b0c33280d74c0d022281f07b44c3204d

SHA256
d1398adebe1c4e58f8fd7ed8c31aad7187f07306750c0a7ffe53a7c94054b6b0

SHA512
0c1eb86adc5635f55c43d8e80e05ddc1e3560639e9500ceb1056f2688696e6bd6ed0f14364206e4975706086def29a6473520fa71e52433361ef13b0ab88ba70

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7349.exe

Filesize
468KB

MD5
62474291f75cb26dddc32a6eba108836

SHA1
60486cc86872e8e7bb5f3fe48167bd0c450235a1

SHA256
f4f02f4ad4bd2362934675ed6aabc3f42813871ac3cce9fe58e4c663fca7c71e

SHA512
cb3f196ecd406a6c182568e778b8be51da8a29e0239f96aa5b5c260956821231f5640cacb90c74fb8998da9f0a788bd2fcf76847232c24ec9703310656febb7e

Download Submit
memory/208-334-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/232-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/376-151-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/396-572-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/404-419-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/432-207-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/452-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/624-324-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/684-523-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/964-187-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1028-468-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1052-260-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1132-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1212-454-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1216-2846-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1248-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1248-3038-0x0000000076EE0000-0x0000000076F04000-memory.dmp

Filesize
144KB

Download
memory/1324-3037-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1476-502-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1488-571-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1520-251-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1536-486-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1616-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1676-66-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1756-433-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1812-257-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1824-325-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1940-174-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1944-500-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2264-435-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2356-424-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2372-182-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2428-532-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2464-543-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2504-41-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2552-278-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2656-248-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2660-241-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2668-453-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2796-40-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2896-143-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2940-115-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3028-21-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3096-65-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3156-221-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3160-121-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3164-343-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3168-91-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3192-373-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3196-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3216-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3380-459-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3460-524-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3464-400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3480-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3560-214-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3564-280-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3568-184-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3580-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3584-342-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3716-86-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3812-185-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3840-326-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3844-335-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3852-469-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3884-460-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3904-542-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3920-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3940-499-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4000-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4032-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4080-224-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4084-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4208-522-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4228-137-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4236-282-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4280-281-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4296-498-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4304-387-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4312-420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4356-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4396-573-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4400-372-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4476-410-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4496-181-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4512-434-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4532-183-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4564-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4604-107-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4608-186-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4628-421-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4636-39-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4716-2578-0x0000000076D40000-0x0000000076DA3000-memory.dmp

Filesize
396KB

Download
memory/4732-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4744-288-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4780-279-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4836-83-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4848-541-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4940-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5024-501-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/13888-2863-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14216-2865-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14476-2908-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14716-2461-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15004-2881-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads