b9068b402ff42d3491ab35cf04fbd7e7649c89213297a509dc2198beaf20ecad

Analysis

max time kernel
120s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 02:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b9068b402ff42d3491ab35cf04fbd7e7649c89213297a509dc2198beaf20ecadN.exe
Size

468KB
MD5

7858965c609549e020541a054a756e90
SHA1

8517cde4d62251ddfff6e137d71002cee97306a9
SHA256

b9068b402ff42d3491ab35cf04fbd7e7649c89213297a509dc2198beaf20ecad
SHA512

186c4b740d81b467c51b9f0039a439c348440dd449e19c42acd156140c2287d8cf6aae0ad3f45deea52fec293a71bb30ea76ca713db9a07632bfd38244cbcaad
SSDEEP

3072:thoIowLdjy8U6bYs5z52Df5EChj+IpO/vHdO4NUrIx3cSCO15lT:thDoYLU6P512DfU0MyrIJLCO1

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4696	Unicorn-33431.exe
2976	Unicorn-1158.exe
4896	Unicorn-30301.exe
1852	Unicorn-20487.exe
220	Unicorn-20487.exe
2876	Unicorn-16765.exe
112	Unicorn-30500.exe
4860	Unicorn-51815.exe
4496	Unicorn-15421.exe
3384	Unicorn-51431.exe
3792	Unicorn-28580.exe
4984	Unicorn-34711.exe
3880	Unicorn-14845.exe
4248	Unicorn-50782.exe
1180	Unicorn-15821.exe
2804	Unicorn-60466.exe
3936	Unicorn-23383.exe
1744	Unicorn-3517.exe
4756	Unicorn-56055.exe
3852	Unicorn-57024.exe
4708	Unicorn-532.exe
1864	Unicorn-30098.exe
424	Unicorn-46242.exe
5016	Unicorn-37311.exe
3600	Unicorn-28391.exe
3388	Unicorn-28126.exe
1796	Unicorn-8525.exe
4320	Unicorn-55687.exe
4372	Unicorn-40128.exe
4196	Unicorn-14737.exe
4408	Unicorn-20445.exe
3604	Unicorn-19188.exe
2408	Unicorn-5453.exe
1588	Unicorn-26087.exe
4616	Unicorn-26884.exe
4916	Unicorn-32631.exe
3304	Unicorn-6673.exe
404	Unicorn-31863.exe
1012	Unicorn-31863.exe
4292	Unicorn-11997.exe
4728	Unicorn-31863.exe
3976	Unicorn-50814.exe
4052	Unicorn-8712.exe
3372	Unicorn-8977.exe
364	Unicorn-1686.exe
1856	Unicorn-51079.exe
2276	Unicorn-18023.exe
3068	Unicorn-18023.exe
5064	Unicorn-30829.exe
1296	Unicorn-30829.exe
2732	Unicorn-25236.exe
2832	Unicorn-4872.exe
2412	Unicorn-18607.exe
4432	Unicorn-64809.exe
4840	Unicorn-25890.exe
1644	Unicorn-55033.exe
3392	Unicorn-34935.exe
4300	Unicorn-1805.exe
2612	Unicorn-27042.exe
1640	Unicorn-46969.exe
3616	Unicorn-1297.exe
4472	Unicorn-53413.exe
4116	Unicorn-2833.exe
1204	Unicorn-2833.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
8044	5476	WerFault.exe
9812	6976	WerFault.exe	294
15996	8104	WerFault.exe	337
16060	5076	WerFault.exe	807

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59131.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7162.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36338.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19695.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49326.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36301.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54018.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42114.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51017.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9528.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20858.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37393.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60334.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18408.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22535.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3281.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6500.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35183.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4698.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62571.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2833.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64752.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37393.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8004.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42320.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1496.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50121.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20436.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30927.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6072.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21812.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7162.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9268.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21233.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17871.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7521.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48308.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5430.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23697.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57417.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20436.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50553.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8513.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65481.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30847.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40194.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47927.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62201.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52674.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37241.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43536.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4506.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18023.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7937.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65026.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4506.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25423.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16752	dwm.exe
Token: SeChangeNotifyPrivilege	16752	dwm.exe
Token: 33	16752	dwm.exe
Token: SeIncBasePriorityPrivilege	16752	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
8	b9068b402ff42d3491ab35cf04fbd7e7649c89213297a509dc2198beaf20ecadN.exe
4696	Unicorn-33431.exe
2976	Unicorn-1158.exe
4896	Unicorn-30301.exe
1852	Unicorn-20487.exe
220	Unicorn-20487.exe
112	Unicorn-30500.exe
2876	Unicorn-16765.exe
4860	Unicorn-51815.exe
4496	Unicorn-15421.exe
3384	Unicorn-51431.exe
4248	Unicorn-50782.exe
3880	Unicorn-14845.exe
3792	Unicorn-28580.exe
4984	Unicorn-34711.exe
1180	Unicorn-15821.exe
2804	Unicorn-60466.exe
1744	Unicorn-3517.exe
3936	Unicorn-23383.exe
3852	Unicorn-57024.exe
4756	Unicorn-56055.exe
4708	Unicorn-532.exe
1864	Unicorn-30098.exe
424	Unicorn-46242.exe
3388	Unicorn-28126.exe
1796	Unicorn-8525.exe
3600	Unicorn-28391.exe
5016	Unicorn-37311.exe
4320	Unicorn-55687.exe
4372	Unicorn-40128.exe
4196	Unicorn-14737.exe
4408	Unicorn-20445.exe
2408	Unicorn-5453.exe
3604	Unicorn-19188.exe
1588	Unicorn-26087.exe
4616	Unicorn-26884.exe
4916	Unicorn-32631.exe
3304	Unicorn-6673.exe
4292	Unicorn-11997.exe
1012	Unicorn-31863.exe
404	Unicorn-31863.exe
4728	Unicorn-31863.exe
3068	Unicorn-18023.exe
2412	Unicorn-18607.exe
3976	Unicorn-50814.exe
364	Unicorn-1686.exe
4432	Unicorn-64809.exe
5064	Unicorn-30829.exe
3372	Unicorn-8977.exe
4052	Unicorn-8712.exe
2832	Unicorn-4872.exe
2732	Unicorn-25236.exe
2276	Unicorn-18023.exe
1856	Unicorn-51079.exe
1296	Unicorn-30829.exe
3392	Unicorn-34935.exe
4300	Unicorn-1805.exe
4840	Unicorn-25890.exe
1644	Unicorn-55033.exe
1640	Unicorn-46969.exe
2612	Unicorn-27042.exe
4472	Unicorn-53413.exe
3616	Unicorn-1297.exe
4116	Unicorn-2833.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 4696	8	b9068b402ff42d3491ab35cf04fbd7e7649c89213297a509dc2198beaf20ecadN.exe	82
PID 8 wrote to memory of 4696	8	b9068b402ff42d3491ab35cf04fbd7e7649c89213297a509dc2198beaf20ecadN.exe	82
PID 8 wrote to memory of 4696	8	b9068b402ff42d3491ab35cf04fbd7e7649c89213297a509dc2198beaf20ecadN.exe	82
PID 4696 wrote to memory of 2976	4696	Unicorn-33431.exe	83
PID 4696 wrote to memory of 2976	4696	Unicorn-33431.exe	83
PID 4696 wrote to memory of 2976	4696	Unicorn-33431.exe	83
PID 8 wrote to memory of 4896	8	b9068b402ff42d3491ab35cf04fbd7e7649c89213297a509dc2198beaf20ecadN.exe	84
PID 8 wrote to memory of 4896	8	b9068b402ff42d3491ab35cf04fbd7e7649c89213297a509dc2198beaf20ecadN.exe	84
PID 8 wrote to memory of 4896	8	b9068b402ff42d3491ab35cf04fbd7e7649c89213297a509dc2198beaf20ecadN.exe	84
PID 2976 wrote to memory of 220	2976	Unicorn-1158.exe	89
PID 2976 wrote to memory of 220	2976	Unicorn-1158.exe	89
PID 2976 wrote to memory of 220	2976	Unicorn-1158.exe	89
PID 4896 wrote to memory of 1852	4896	Unicorn-30301.exe	90
PID 4896 wrote to memory of 1852	4896	Unicorn-30301.exe	90
PID 4896 wrote to memory of 1852	4896	Unicorn-30301.exe	90
PID 4696 wrote to memory of 2876	4696	Unicorn-33431.exe	92
PID 4696 wrote to memory of 2876	4696	Unicorn-33431.exe	92
PID 4696 wrote to memory of 2876	4696	Unicorn-33431.exe	92
PID 8 wrote to memory of 112	8	b9068b402ff42d3491ab35cf04fbd7e7649c89213297a509dc2198beaf20ecadN.exe	91
PID 8 wrote to memory of 112	8	b9068b402ff42d3491ab35cf04fbd7e7649c89213297a509dc2198beaf20ecadN.exe	91
PID 8 wrote to memory of 112	8	b9068b402ff42d3491ab35cf04fbd7e7649c89213297a509dc2198beaf20ecadN.exe	91
PID 1852 wrote to memory of 4860	1852	Unicorn-20487.exe	94
PID 1852 wrote to memory of 4860	1852	Unicorn-20487.exe	94
PID 1852 wrote to memory of 4860	1852	Unicorn-20487.exe	94
PID 4896 wrote to memory of 4496	4896	Unicorn-30301.exe	95
PID 4896 wrote to memory of 4496	4896	Unicorn-30301.exe	95
PID 4896 wrote to memory of 4496	4896	Unicorn-30301.exe	95
PID 220 wrote to memory of 3384	220	Unicorn-20487.exe	96
PID 220 wrote to memory of 3384	220	Unicorn-20487.exe	96
PID 220 wrote to memory of 3384	220	Unicorn-20487.exe	96
PID 4696 wrote to memory of 3792	4696	Unicorn-33431.exe	97
PID 4696 wrote to memory of 3792	4696	Unicorn-33431.exe	97
PID 4696 wrote to memory of 3792	4696	Unicorn-33431.exe	97
PID 112 wrote to memory of 4984	112	Unicorn-30500.exe	98
PID 112 wrote to memory of 4984	112	Unicorn-30500.exe	98
PID 112 wrote to memory of 4984	112	Unicorn-30500.exe	98
PID 2976 wrote to memory of 3880	2976	Unicorn-1158.exe	99
PID 2976 wrote to memory of 3880	2976	Unicorn-1158.exe	99
PID 2976 wrote to memory of 3880	2976	Unicorn-1158.exe	99
PID 8 wrote to memory of 4248	8	b9068b402ff42d3491ab35cf04fbd7e7649c89213297a509dc2198beaf20ecadN.exe	100
PID 8 wrote to memory of 4248	8	b9068b402ff42d3491ab35cf04fbd7e7649c89213297a509dc2198beaf20ecadN.exe	100
PID 8 wrote to memory of 4248	8	b9068b402ff42d3491ab35cf04fbd7e7649c89213297a509dc2198beaf20ecadN.exe	100
PID 2876 wrote to memory of 1180	2876	Unicorn-16765.exe	103
PID 2876 wrote to memory of 1180	2876	Unicorn-16765.exe	103
PID 2876 wrote to memory of 1180	2876	Unicorn-16765.exe	103
PID 4860 wrote to memory of 2804	4860	Unicorn-51815.exe	104
PID 4860 wrote to memory of 2804	4860	Unicorn-51815.exe	104
PID 4860 wrote to memory of 2804	4860	Unicorn-51815.exe	104
PID 1852 wrote to memory of 1744	1852	Unicorn-20487.exe	105
PID 1852 wrote to memory of 1744	1852	Unicorn-20487.exe	105
PID 1852 wrote to memory of 1744	1852	Unicorn-20487.exe	105
PID 3880 wrote to memory of 3936	3880	Unicorn-14845.exe	106
PID 3880 wrote to memory of 3936	3880	Unicorn-14845.exe	106
PID 3880 wrote to memory of 3936	3880	Unicorn-14845.exe	106
PID 4496 wrote to memory of 4756	4496	Unicorn-15421.exe	107
PID 4496 wrote to memory of 4756	4496	Unicorn-15421.exe	107
PID 4496 wrote to memory of 4756	4496	Unicorn-15421.exe	107
PID 2976 wrote to memory of 3852	2976	Unicorn-1158.exe	108
PID 2976 wrote to memory of 3852	2976	Unicorn-1158.exe	108
PID 2976 wrote to memory of 3852	2976	Unicorn-1158.exe	108
PID 4896 wrote to memory of 4708	4896	Unicorn-30301.exe	109
PID 4896 wrote to memory of 4708	4896	Unicorn-30301.exe	109
PID 4896 wrote to memory of 4708	4896	Unicorn-30301.exe	109
PID 4248 wrote to memory of 1864	4248	Unicorn-50782.exe	110

C:\Users\Admin\AppData\Local\Temp\b9068b402ff42d3491ab35cf04fbd7e7649c89213297a509dc2198beaf20ecadN.exe
"C:\Users\Admin\AppData\Local\Temp\b9068b402ff42d3491ab35cf04fbd7e7649c89213297a509dc2198beaf20ecadN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:8
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33431.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33431.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1158.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1158.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20487.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51431.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28391.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31863.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5560.exe
        8⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31543.exe
        9⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28610.exe
        10⤵
        
        PID:11396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31537.exe
        10⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10072.exe
        9⤵
        
        PID:12192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46336.exe
        9⤵
        
        PID:15560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23697.exe
        9⤵
        
        PID:8484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25967.exe
        8⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2161.exe
        9⤵
        
        PID:8256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42679.exe
        10⤵
        
        PID:15336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36842.exe
        10⤵
        
        PID:17220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30493.exe
        9⤵
        
        PID:14280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7137.exe
        9⤵
        
        PID:17160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36207.exe
        8⤵
        
        PID:1192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54436.exe
        8⤵
        
        PID:4016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28061.exe
        7⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13734.exe
        8⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36162.exe
        9⤵
        
        PID:9932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4136.exe
        9⤵
        
        PID:13884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29707.exe
        9⤵
        
        PID:10348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26088.exe
        8⤵
        
        PID:9700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe
        8⤵
        
        PID:14992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7162.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19524.exe
        7⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14065.exe
        8⤵
        
        PID:10504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4815.exe
        8⤵
        
        PID:15280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23697.exe
        8⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38777.exe
        7⤵
        
        PID:8860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15071.exe
        7⤵
        
        PID:13740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54436.exe
        7⤵
        
        PID:748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30829.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29033.exe
        7⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16754.exe
        8⤵
        
        PID:10556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4815.exe
        8⤵
        
        PID:15296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23697.exe
        8⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28575.exe
        7⤵
        
        PID:10084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64073.exe
        7⤵
        
        PID:13896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54436.exe
        7⤵
        
        PID:3800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48896.exe
        6⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48130.exe
        7⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35954.exe
        8⤵
        
        PID:9072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36320.exe
        8⤵
        
        PID:12048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18488.exe
        8⤵
        
        PID:16100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53906.exe
        8⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42637.exe
        7⤵
        
        PID:8772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe
        7⤵
        
        PID:13776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7162.exe
        7⤵
        
        PID:8704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1752.exe
        6⤵
        
        PID:8076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6500.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55241.exe
        6⤵
        
        PID:14500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37332.exe
        6⤵
        
        PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8525.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18023.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55794.exe
        7⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exe
        8⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11014.exe
        9⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37592.exe
        9⤵
        
        PID:14244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46059.exe
        9⤵
        
        PID:16564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17640.exe
        8⤵
        
        PID:10144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34015.exe
        8⤵
        
        PID:13992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62571.exe
        8⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62878.exe
        7⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6976 -s 632
        8⤵
        Program crash
        
        PID:9812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7935.exe
        7⤵
        
        PID:10484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29129.exe
        7⤵
        
        PID:14456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52837.exe
        7⤵
        
        PID:4856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45161.exe
        6⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52674.exe
        7⤵
        
        PID:9116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59865.exe
        7⤵
        
        PID:13240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46059.exe
        7⤵
        
        PID:16528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57417.exe
        6⤵
        
        PID:8400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11620.exe
        6⤵
        
        PID:12476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37924.exe
        6⤵
        
        PID:16520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18607.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5249.exe
        6⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54658.exe
        7⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42114.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15277.exe
        8⤵
        
        PID:12440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe
        8⤵
        
        PID:17400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10541.exe
        7⤵
        
        PID:8756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe
        7⤵
        
        PID:15016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21041.exe
        7⤵
        
        PID:10424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19432.exe
        6⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54183.exe
        7⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32363.exe
        7⤵
        
        PID:8540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25423.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29129.exe
        6⤵
        
        PID:13544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25545.exe
        5⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62375.exe
        6⤵
        
        PID:8124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14392.exe
        6⤵
        
        PID:11328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51328.exe
        6⤵
        
        PID:14264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23697.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53536.exe
        5⤵
        
        PID:5396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37720.exe
        5⤵
        
        PID:12036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44066.exe
        5⤵
        
        PID:15548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62899.exe
        5⤵
        
        PID:8468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14845.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23383.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51079.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47927.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54402.exe
        8⤵
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26792.exe
        8⤵
        
        PID:12128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46336.exe
        8⤵
        
        PID:15504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23697.exe
        8⤵
        
        PID:8564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3597.exe
        7⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe
        8⤵
        
        PID:12460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32363.exe
        8⤵
        
        PID:8424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64256.exe
        7⤵
        
        PID:11732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1656.exe
        7⤵
        
        PID:14592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47778.exe
        7⤵
        
        PID:7712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29400.exe
        6⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54942.exe
        7⤵
        
        PID:10620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23263.exe
        7⤵
        
        PID:14428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
        7⤵
        
        PID:16152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27332.exe
        6⤵
        
        PID:7284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36793.exe
        6⤵
        
        PID:11636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18463.exe
        6⤵
        
        PID:16200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24227.exe
        6⤵
        
        PID:7640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30829.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5249.exe
        6⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18898.exe
        7⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31543.exe
        8⤵
        
        PID:7948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe
        9⤵
        
        PID:12848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7578.exe
        9⤵
        
        PID:11796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29096.exe
        8⤵
        
        PID:12228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25396.exe
        8⤵
        
        PID:15684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23697.exe
        8⤵
        
        PID:8652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39144.exe
        7⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64752.exe
        7⤵
        
        PID:11480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43849.exe
        7⤵
        
        PID:16172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7162.exe
        7⤵
        
        PID:16972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32301.exe
        6⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16935.exe
        7⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51017.exe
        7⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37984.exe
        7⤵
        
        PID:15632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53906.exe
        7⤵
        
        PID:2900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59616.exe
        6⤵
        
        PID:8360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39289.exe
        6⤵
        
        PID:11700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45765.exe
        6⤵
        
        PID:15648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21187.exe
        6⤵
        
        PID:1676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58320.exe
        5⤵
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54018.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5601.exe
        7⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20280.exe
        7⤵
        
        PID:13952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24033.exe
        7⤵
        
        PID:396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35912.exe
        6⤵
        
        PID:10960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23263.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29899.exe
        6⤵
        
        PID:1232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15133.exe
        5⤵
        
        PID:7852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53872.exe
        5⤵
        
        PID:12168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27000.exe
        5⤵
        
        PID:15492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21395.exe
        5⤵
        
        PID:16688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57024.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31863.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5560.exe
        6⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54018.exe
        7⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3357.exe
        7⤵
        
        PID:12108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46336.exe
        7⤵
        
        PID:15600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23697.exe
        7⤵
        
        PID:8688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25967.exe
        6⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37474.exe
        7⤵
        
        PID:16044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24033.exe
        7⤵
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36207.exe
        6⤵
        
        PID:12404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41336.exe
        6⤵
        
        PID:15728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53367.exe
        6⤵
        
        PID:1428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54574.exe
        5⤵
        
        PID:5104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17362.exe
        6⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32311.exe
        7⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3357.exe
        7⤵
        
        PID:12068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46336.exe
        7⤵
        
        PID:15512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23697.exe
        7⤵
        
        PID:8684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36840.exe
        6⤵
        
        PID:7812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44873.exe
        6⤵
        
        PID:12384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4506.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46037.exe
        5⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12326.exe
        6⤵
        
        PID:9028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14420.exe
        6⤵
        
        PID:12488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe
        6⤵
        
        PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65481.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59323.exe
        6⤵
        
        PID:15888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30623.exe
        5⤵
        
        PID:11696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32905.exe
        5⤵
        
        PID:4020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8712.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38528.exe
        5⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16935.exe
        6⤵
        
        PID:7828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39008.exe
        6⤵
        
        PID:12008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52837.exe
        6⤵
        
        PID:6452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18008.exe
        5⤵
        
        PID:8504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6228.exe
        5⤵
        
        PID:11124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29229.exe
        5⤵
        
        PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2697.exe
        5⤵
        
        PID:8412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24004.exe
      4⤵
      PID:5476
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5476 -s 640
        5⤵
        Program crash
        
        PID:8044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56894.exe
      4⤵
      PID:7056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30594.exe
        5⤵
        
        PID:10532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        5⤵
        
        PID:14448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60288.exe
        5⤵
        
        PID:15652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23697.exe
        5⤵
        
        PID:8528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-870.exe
      4⤵
      PID:10628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65000.exe
      4⤵
      PID:13800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27570.exe
      4⤵
      PID:3476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16765.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16765.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15821.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55687.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25890.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20818.exe
        7⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52338.exe
        8⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52098.exe
        9⤵
        
        PID:9008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15661.exe
        9⤵
        
        PID:12300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe
        9⤵
        
        PID:17376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36840.exe
        8⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12307.exe
        9⤵
        
        PID:17132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44873.exe
        8⤵
        
        PID:11552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20858.exe
        8⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39976.exe
        7⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3281.exe
        8⤵
        
        PID:8912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12973.exe
        8⤵
        
        PID:11980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe
        8⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3508.exe
        7⤵
        
        PID:8328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23145.exe
        7⤵
        
        PID:11660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50560.exe
        7⤵
        
        PID:16376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24227.exe
        7⤵
        
        PID:8712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44585.exe
        6⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47746.exe
        7⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11590.exe
        8⤵
        
        PID:11180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6840.exe
        8⤵
        
        PID:15124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32363.exe
        8⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17640.exe
        7⤵
        
        PID:10212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe
        7⤵
        
        PID:14372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7162.exe
        7⤵
        
        PID:8304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20863.exe
        6⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49250.exe
        7⤵
        
        PID:10748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52009.exe
        7⤵
        
        PID:14496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59467.exe
        7⤵
        
        PID:180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9005.exe
        6⤵
        
        PID:10640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20463.exe
        6⤵
        
        PID:12484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19005.exe
        6⤵
        
        PID:3928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55033.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7937.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64466.exe
        7⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11688.exe
        7⤵
        
        PID:10700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23263.exe
        7⤵
        
        PID:13532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62571.exe
        7⤵
        
        PID:212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31160.exe
        6⤵
        
        PID:8136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53488.exe
        6⤵
        
        PID:11188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17400.exe
        6⤵
        
        PID:15176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57488.exe
        6⤵
        
        PID:13552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24227.exe
        6⤵
        
        PID:9368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8543.exe
        5⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15073.exe
        6⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32363.exe
        7⤵
        
        PID:6672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17640.exe
        6⤵
        
        PID:10164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe
        6⤵
        
        PID:13748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62571.exe
        6⤵
        
        PID:1220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43065.exe
        5⤵
        
        PID:7164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-340.exe
        5⤵
        
        PID:10572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3928.exe
        5⤵
        
        PID:13808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32137.exe
        5⤵
        
        PID:232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40128.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34935.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
        6⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28855.exe
        7⤵
        
        PID:9036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39096.exe
        7⤵
        
        PID:12344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52837.exe
        7⤵
        
        PID:3400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42320.exe
        6⤵
        
        PID:8224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5080.exe
        6⤵
        
        PID:7808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35183.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24227.exe
        6⤵
        
        PID:6604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44009.exe
        5⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25271.exe
        6⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19266.exe
        7⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54697.exe
        7⤵
        
        PID:13948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59467.exe
        7⤵
        
        PID:7920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18408.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62571.exe
        6⤵
        
        PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27993.exe
        5⤵
        
        PID:7312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23693.exe
        6⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 80
        7⤵
        Program crash
        
        PID:16060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23857.exe
        6⤵
        
        PID:17168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61456.exe
        5⤵
        
        PID:11740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41992.exe
        5⤵
        
        PID:14260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37924.exe
        5⤵
        
        PID:16736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1805.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8513.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31415.exe
        6⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28855.exe
        7⤵
        
        PID:8932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12973.exe
        7⤵
        
        PID:11988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1496.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe
        6⤵
        
        PID:13720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62571.exe
        6⤵
        
        PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4056.exe
        5⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6710.exe
        6⤵
        
        PID:11856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32363.exe
        6⤵
        
        PID:8544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60889.exe
        5⤵
        
        PID:8196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8351.exe
        5⤵
        
        PID:15300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31242.exe
        5⤵
        
        PID:5824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7663.exe
      4⤵
      PID:2544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29239.exe
        5⤵
        
        PID:7668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36320.exe
        5⤵
        
        PID:12028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52837.exe
        5⤵
        
        PID:10660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7997.exe
      4⤵
      PID:8152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38258.exe
      4⤵
      PID:12120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22535.exe
      4⤵
      PID:15672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21442.exe
      4⤵
      PID:7256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28580.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28580.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1686.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8134.exe
        6⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47175.exe
        7⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52290.exe
        8⤵
        
        PID:8976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20072.exe
        8⤵
        
        PID:11940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48146.exe
        8⤵
        
        PID:16612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10541.exe
        7⤵
        
        PID:8748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe
        7⤵
        
        PID:15004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52754.exe
        7⤵
        
        PID:16092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34074.exe
        7⤵
        
        PID:8204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11949.exe
        6⤵
        
        PID:6632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25423.exe
        6⤵
        
        PID:10392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29129.exe
        6⤵
        
        PID:13600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53138.exe
        6⤵
        
        PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28632.exe
        5⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45383.exe
        6⤵
        
        PID:9100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6232.exe
        6⤵
        
        PID:12376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53922.exe
        6⤵
        
        PID:10548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49616.exe
        5⤵
        
        PID:7648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3544.exe
        5⤵
        
        PID:14348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54436.exe
        5⤵
        
        PID:3456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4872.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64242.exe
        5⤵
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30434.exe
        6⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51714.exe
        7⤵
        
        PID:7848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48053.exe
        7⤵
        
        PID:12320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe
        7⤵
        
        PID:6012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16856.exe
        6⤵
        
        PID:8720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60341.exe
        6⤵
        
        PID:11848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20858.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20781.exe
        5⤵
        
        PID:6800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33106.exe
        6⤵
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2616.exe
        6⤵
        
        PID:13892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7521.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31375.exe
        5⤵
        
        PID:10116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23737.exe
        5⤵
        
        PID:13676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37370.exe
        5⤵
        
        PID:7000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17375.exe
      4⤵
      PID:5528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14801.exe
        5⤵
        
        PID:7788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25031.exe
        6⤵
        
        PID:10756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        6⤵
        
        PID:13524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24033.exe
        6⤵
        
        PID:1068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1325.exe
        5⤵
        
        PID:9956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10767.exe
        5⤵
        
        PID:14116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23697.exe
        5⤵
        
        PID:8640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62201.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39042.exe
        5⤵
        
        PID:7356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4136.exe
        5⤵
        
        PID:13876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24033.exe
        5⤵
        
        PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56661.exe
      4⤵
      PID:10924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3928.exe
      4⤵
      PID:12260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6513.exe
      4⤵
      PID:15488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62899.exe
      4⤵
      PID:8320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28126.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28126.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8977.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15233.exe
        5⤵
        
        PID:2628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56770.exe
        6⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49223.exe
        7⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51017.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61502.exe
        7⤵
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13997.exe
        6⤵
        
        PID:8264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51509.exe
        6⤵
        
        PID:12960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37377.exe
        6⤵
        
        PID:10604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8004.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60334.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48528.exe
        5⤵
        
        PID:14528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24227.exe
        5⤵
        
        PID:8732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13069.exe
      4⤵
      PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39495.exe
        5⤵
        
        PID:7032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45202.exe
        6⤵
        
        PID:10256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        6⤵
        
        PID:13540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61502.exe
        6⤵
        
        PID:4228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33976.exe
        5⤵
        
        PID:10056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe
        5⤵
        
        PID:13780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29899.exe
        5⤵
        
        PID:14236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4719.exe
      4⤵
      PID:7556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63415.exe
        5⤵
        
        PID:14016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9930.exe
        5⤵
        
        PID:16636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26302.exe
      4⤵
      PID:10880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20463.exe
      4⤵
      PID:13624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19005.exe
      4⤵
      PID:5252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25236.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25236.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27864.exe
      4⤵
      PID:5888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57154.exe
        5⤵
        
        PID:6256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50121.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe
        6⤵
        
        PID:13812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29899.exe
        6⤵
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10541.exe
        5⤵
        
        PID:10036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe
        5⤵
        
        PID:13708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62571.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32783.exe
      4⤵
      PID:6876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33831.exe
        5⤵
        
        PID:14316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32196.exe
        5⤵
        
        PID:6624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31289.exe
      4⤵
      PID:10336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20463.exe
      4⤵
      PID:14404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3738.exe
      4⤵
      PID:5424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28792.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28792.exe
    3⤵
    PID:3184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47175.exe
      4⤵
      PID:6328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29239.exe
        5⤵
        
        PID:8064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39112.exe
        5⤵
        
        PID:13276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29707.exe
        5⤵
        
        PID:10400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17640.exe
      4⤵
      PID:10188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe
      4⤵
      PID:15024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7162.exe
      4⤵
      PID:8656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23414.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23414.exe
    3⤵
    PID:6372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30594.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
      4⤵
      PID:13616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29899.exe
      4⤵
      PID:3804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
    3⤵
    PID:10352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59664.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59664.exe
    3⤵
    PID:13640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1528.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1528.exe
    3⤵
    PID:1848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52467.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52467.exe
    3⤵
    PID:5308
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30301.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30301.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20487.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20487.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51815.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60466.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14737.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27042.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40418.exe
        8⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48130.exe
        9⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11014.exe
        10⤵
        
        PID:11268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30493.exe
        10⤵
        
        PID:14112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24033.exe
        10⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50718.exe
        9⤵
        
        PID:10312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23263.exe
        9⤵
        
        PID:13552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2152.exe
        9⤵
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53906.exe
        9⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47689.exe
        8⤵
        
        PID:8068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31362.exe
        9⤵
        
        PID:10996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        9⤵
        
        PID:13592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29899.exe
        9⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9300.exe
        8⤵
        
        PID:11024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29129.exe
        8⤵
        
        PID:13512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53906.exe
        8⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44585.exe
        7⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39495.exe
        8⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-422.exe
        9⤵
        
        PID:9096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        9⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24033.exe
        9⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33976.exe
        8⤵
        
        PID:10072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49326.exe
        8⤵
        
        PID:13504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37386.exe
        8⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27993.exe
        7⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11014.exe
        8⤵
        
        PID:11316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37592.exe
        8⤵
        
        PID:14208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32363.exe
        8⤵
        
        PID:8288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61456.exe
        7⤵
        
        PID:11704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41992.exe
        7⤵
        
        PID:14308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48308.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46969.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47927.exe
        7⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30450.exe
        8⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17640.exe
        8⤵
        
        PID:10156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe
        8⤵
        
        PID:13760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29899.exe
        8⤵
        
        PID:444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7512.exe
        7⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5953.exe
        8⤵
        
        PID:15736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10298.exe
        8⤵
        
        PID:728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28303.exe
        7⤵
        
        PID:10836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29129.exe
        7⤵
        
        PID:13584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36301.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28911.exe
        6⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12326.exe
        7⤵
        
        PID:9088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39008.exe
        7⤵
        
        PID:11352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
        7⤵
        
        PID:1476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48752.exe
        6⤵
        
        PID:7624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36738.exe
        6⤵
        
        PID:12216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29772.exe
        6⤵
        
        PID:3360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25733.exe
        6⤵
        
        PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20445.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1297.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
        7⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7521.exe
        8⤵
        
        PID:10044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24033.exe
        8⤵
        
        PID:436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42320.exe
        7⤵
        
        PID:8232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5080.exe
        7⤵
        
        PID:11544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35183.exe
        7⤵
        
        PID:16292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31242.exe
        7⤵
        
        PID:13668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44009.exe
        6⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36338.exe
        7⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe
        8⤵
        
        PID:12420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32363.exe
        8⤵
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15277.exe
        7⤵
        
        PID:12432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe
        7⤵
        
        PID:17392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9268.exe
        6⤵
        
        PID:7976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22958.exe
        6⤵
        
        PID:12144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43536.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24227.exe
        6⤵
        
        PID:3592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53413.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5633.exe
        6⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23906.exe
        7⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20551.exe
        8⤵
        
        PID:12984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40194.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17640.exe
        7⤵
        
        PID:10096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44114.exe
        8⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24033.exe
        8⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe
        7⤵
        
        PID:15036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7162.exe
        7⤵
        
        PID:8604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20968.exe
        6⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45351.exe
        7⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7578.exe
        7⤵
        
        PID:11504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24463.exe
        6⤵
        
        PID:10468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29129.exe
        6⤵
        
        PID:13328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20858.exe
        6⤵
        
        PID:6468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51305.exe
        5⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3281.exe
        6⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23250.exe
        7⤵
        
        PID:13848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59131.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39008.exe
        6⤵
        
        PID:12184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43294.exe
        6⤵
        
        PID:3192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
        6⤵
        
        PID:16012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32216.exe
        5⤵
        
        PID:7172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49239.exe
        5⤵
        
        PID:12940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59474.exe
        5⤵
        
        PID:4012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3517.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26087.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29559.exe
        6⤵
        
        PID:1700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19016.exe
        6⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46210.exe
        7⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15329.exe
        8⤵
        
        PID:11256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1848.exe
        8⤵
        
        PID:15716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22846.exe
        8⤵
        
        PID:11788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17640.exe
        7⤵
        
        PID:10196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe
        7⤵
        
        PID:14156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29707.exe
        7⤵
        
        PID:10172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37008.exe
        6⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-422.exe
        7⤵
        
        PID:8856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        7⤵
        
        PID:14420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26463.exe
        7⤵
        
        PID:16228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29899.exe
        7⤵
        
        PID:4816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65113.exe
        6⤵
        
        PID:10664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20463.exe
        6⤵
        
        PID:14392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53668.exe
        6⤵
        
        PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9309.exe
        5⤵
        
        PID:1372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9089.exe
        6⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25271.exe
        7⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28866.exe
        8⤵
        
        PID:9836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42986.exe
        9⤵
        
        PID:16620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        8⤵
        
        PID:14436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46059.exe
        8⤵
        
        PID:16592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18408.exe
        7⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe
        7⤵
        
        PID:13788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28939.exe
        7⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23272.exe
        6⤵
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28610.exe
        7⤵
        
        PID:12248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40178.exe
        7⤵
        
        PID:9996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59248.exe
        6⤵
        
        PID:10676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29412.exe
        7⤵
        
        PID:17200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29129.exe
        6⤵
        
        PID:13608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4698.exe
        6⤵
        
        PID:2756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45440.exe
        5⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3281.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22479.exe
        6⤵
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43294.exe
        6⤵
        
        PID:460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
        6⤵
        
        PID:14068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56441.exe
        5⤵
        
        PID:6728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38688.exe
        5⤵
        
        PID:10364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50553.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15801.exe
        5⤵
        
        PID:13988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26884.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62039.exe
        5⤵
        
        PID:1920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34516.exe
        6⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5430.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        7⤵
        
        PID:13560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24033.exe
        7⤵
        
        PID:15748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37241.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31215.exe
        6⤵
        
        PID:13920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4698.exe
        6⤵
        
        PID:16108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39981.exe
        5⤵
        
        PID:6172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29239.exe
        6⤵
        
        PID:8956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12973.exe
        6⤵
        
        PID:12788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60288.exe
        6⤵
        
        PID:13556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23697.exe
        6⤵
        
        PID:17196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28959.exe
        5⤵
        
        PID:9716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56398.exe
        5⤵
        
        PID:14180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44068.exe
        5⤵
        
        PID:1528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19480.exe
      4⤵
      PID:1996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9089.exe
        5⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36338.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13357.exe
        6⤵
        
        PID:11880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42400.exe
        6⤵
        
        PID:16088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50990.exe
        6⤵
        
        PID:16336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7162.exe
        6⤵
        
        PID:8488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12232.exe
        5⤵
        
        PID:7460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17092.exe
        5⤵
        
        PID:12056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52201.exe
        5⤵
        
        PID:15532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7162.exe
        5⤵
        
        PID:17192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19012.exe
      4⤵
      PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40770.exe
        5⤵
        
        PID:9828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61998.exe
        5⤵
        
        PID:14188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23841.exe
        5⤵
        
        PID:10812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15096.exe
      4⤵
      PID:8160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23841.exe
      4⤵
      PID:12252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57319.exe
      4⤵
      PID:15784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1562.exe
      4⤵
      PID:17032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15421.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15421.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56055.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6673.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30711.exe
        6⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64450.exe
        7⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30450.exe
        8⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23282.exe
        9⤵
        
        PID:8324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4815.exe
        9⤵
        
        PID:15288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23697.exe
        9⤵
        
        PID:15300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17640.exe
        8⤵
        
        PID:10236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        8⤵
        
        PID:13648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29899.exe
        8⤵
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49422.exe
        7⤵
        
        PID:7528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61538.exe
        8⤵
        
        PID:10540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        8⤵
        
        PID:13576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26463.exe
        8⤵
        
        PID:16224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29899.exe
        8⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27727.exe
        7⤵
        
        PID:10860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16061.exe
        7⤵
        
        PID:14220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20273.exe
        7⤵
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29400.exe
        6⤵
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42114.exe
        7⤵
        
        PID:7896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22184.exe
        7⤵
        
        PID:12500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30465.exe
        7⤵
        
        PID:16364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34431.exe
        6⤵
        
        PID:680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46393.exe
        6⤵
        
        PID:12080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43536.exe
        6⤵
        
        PID:15480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24227.exe
        6⤵
        
        PID:17180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32285.exe
        5⤵
        
        PID:3612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16210.exe
        6⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35954.exe
        7⤵
        
        PID:9056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22479.exe
        7⤵
        
        PID:12156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43294.exe
        7⤵
        
        PID:15724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
        7⤵
        
        PID:708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20696.exe
        6⤵
        
        PID:692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64752.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2916.exe
        6⤵
        
        PID:15972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24227.exe
        6⤵
        
        PID:17332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19695.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3281.exe
        6⤵
        
        PID:9080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28745.exe
        6⤵
        
        PID:14356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57488.exe
        6⤵
        
        PID:16092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37370.exe
        6⤵
        
        PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18589.exe
        5⤵
        
        PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61952.exe
        5⤵
        
        PID:11340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18648.exe
        5⤵
        
        PID:16232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15801.exe
        5⤵
        
        PID:5972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11997.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28498.exe
        5⤵
        
        PID:4548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59847.exe
        6⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52674.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13357.exe
        7⤵
        
        PID:11892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
        7⤵
        
        PID:14284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36840.exe
        6⤵
        
        PID:7772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44873.exe
        6⤵
        
        PID:7352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20858.exe
        6⤵
        
        PID:3500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30847.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52482.exe
        6⤵
        
        PID:9044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28745.exe
        6⤵
        
        PID:14364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57488.exe
        6⤵
        
        PID:16036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37370.exe
        6⤵
        
        PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61833.exe
        5⤵
        
        PID:9728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15071.exe
        5⤵
        
        PID:13692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37370.exe
        5⤵
        
        PID:636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21983.exe
      4⤵
      PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58695.exe
        5⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15799.exe
        6⤵
        
        PID:9252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        6⤵
        
        PID:13664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24033.exe
        6⤵
        
        PID:16308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37032.exe
        5⤵
        
        PID:7276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44873.exe
        5⤵
        
        PID:9876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37370.exe
        5⤵
        
        PID:1780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36313.exe
      4⤵
      PID:6316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16935.exe
        5⤵
        
        PID:8048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39008.exe
        5⤵
        
        PID:7084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe
        5⤵
        
        PID:16744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47776.exe
      4⤵
      PID:7780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22152.exe
      4⤵
      PID:9852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12545.exe
      4⤵
      PID:16016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26777.exe
      4⤵
      PID:5248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-532.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-532.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31863.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3526.exe
        5⤵
        
        PID:712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26407.exe
        6⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30978.exe
        7⤵
        
        PID:10444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        7⤵
        
        PID:13012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24033.exe
        7⤵
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13597.exe
        6⤵
        
        PID:6392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30927.exe
        6⤵
        
        PID:11612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27129.exe
        6⤵
        
        PID:16216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4698.exe
        6⤵
        
        PID:15752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32472.exe
        5⤵
        
        PID:6504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33463.exe
        6⤵
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51017.exe
        6⤵
        
        PID:12584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50576.exe
        5⤵
        
        PID:7768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47353.exe
        5⤵
        
        PID:9808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22111.exe
        5⤵
        
        PID:16148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20803.exe
        5⤵
        
        PID:5444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27464.exe
      4⤵
      PID:3364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65026.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35954.exe
        6⤵
        
        PID:9064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39096.exe
        6⤵
        
        PID:12336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30465.exe
        6⤵
        
        PID:13852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36840.exe
        5⤵
        
        PID:7792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31503.exe
        5⤵
        
        PID:11584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43849.exe
        5⤵
        
        PID:16180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7162.exe
        5⤵
        
        PID:17216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53717.exe
      4⤵
      PID:6148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12326.exe
        5⤵
        
        PID:8992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6616.exe
        5⤵
        
        PID:9812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe
        5⤵
        
        PID:5592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48752.exe
      4⤵
      PID:7912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32173.exe
      4⤵
      PID:12952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16377.exe
      4⤵
      PID:10920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50814.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50814.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47927.exe
      4⤵
      PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30450.exe
        5⤵
        
        PID:6980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39042.exe
        6⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62852.exe
        7⤵
        
        PID:17176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
        7⤵
        
        PID:11476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17887.exe
        6⤵
        
        PID:14696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29899.exe
        6⤵
        
        PID:3240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17640.exe
        5⤵
        
        PID:10136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe
        5⤵
        
        PID:14340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7162.exe
        5⤵
        
        PID:8608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38656.exe
      4⤵
      PID:7296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4584.exe
      4⤵
      PID:11720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58528.exe
      4⤵
      PID:15108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24227.exe
      4⤵
      PID:7212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55136.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55136.exe
    3⤵
    PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32882.exe
      4⤵
      PID:8392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19496.exe
      4⤵
      PID:11784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48565.exe
      4⤵
      PID:2372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15608.exe
      4⤵
      PID:16240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
      4⤵
      PID:15500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55470.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55470.exe
    3⤵
    PID:7884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54402.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54402.exe
    3⤵
    PID:12176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22535.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22535.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:15572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1562.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1562.exe
    3⤵
    PID:8416
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30500.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30500.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34711.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34711.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5453.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2833.exe
        5⤵
        Executes dropped EXE
        
        PID:1204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
        6⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51714.exe
        7⤵
        
        PID:9164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48053.exe
        7⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43294.exe
        7⤵
        
        PID:15748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
        7⤵
        
        PID:4184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42320.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36207.exe
        6⤵
        
        PID:12284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41336.exe
        6⤵
        
        PID:15840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37924.exe
        6⤵
        
        PID:16704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30168.exe
        5⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52290.exe
        6⤵
        
        PID:9128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15277.exe
        6⤵
        
        PID:12448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15119.exe
        6⤵
        
        PID:15696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44446.exe
        6⤵
        
        PID:15528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7162.exe
        6⤵
        
        PID:8448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51344.exe
        5⤵
        
        PID:8000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31977.exe
        5⤵
        
        PID:12264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55269.exe
        5⤵
        
        PID:15656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4506.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
      4⤵
      PID:2060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
        5⤵
        
        PID:6708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3281.exe
        6⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36320.exe
        6⤵
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
        6⤵
        
        PID:4076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42320.exe
        5⤵
        
        PID:8216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37858.exe
        6⤵
        
        PID:15856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26497.exe
        6⤵
        
        PID:8384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36207.exe
        5⤵
        
        PID:12352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21571.exe
        5⤵
        
        PID:15544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16328.exe
      4⤵
      PID:996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3281.exe
        5⤵
        
        PID:8940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12973.exe
        5⤵
        
        PID:12012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44446.exe
        5⤵
        
        PID:16088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7162.exe
        5⤵
        
        PID:8624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24532.exe
      4⤵
      PID:8104
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8104 -s 532
        5⤵
        Program crash
        
        PID:15996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23496.exe
      4⤵
      PID:12220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23126.exe
      4⤵
      PID:15640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16393.exe
      4⤵
      PID:17140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19188.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19188.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2833.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47927.exe
        5⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47175.exe
        6⤵
        
        PID:372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9441.exe
        7⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59865.exe
        7⤵
        
        PID:13224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46059.exe
        7⤵
        
        PID:16728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17640.exe
        6⤵
        
        PID:10204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe
        6⤵
        
        PID:13768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62571.exe
        6⤵
        
        PID:1736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22612.exe
        5⤵
        
        PID:8180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28610.exe
        6⤵
        
        PID:11364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32363.exe
        6⤵
        
        PID:8420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19000.exe
        5⤵
        
        PID:10848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39125.exe
        5⤵
        
        PID:13976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24227.exe
        5⤵
        
        PID:17372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62265.exe
      4⤵
      PID:6136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58450.exe
        5⤵
        
        PID:8100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47374.exe
        5⤵
        
        PID:12568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53922.exe
        5⤵
        
        PID:10672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27332.exe
      4⤵
      PID:6600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36207.exe
      4⤵
      PID:12136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18093.exe
      4⤵
      PID:15744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52599.exe
      4⤵
      PID:5408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11613.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11613.exe
    3⤵
    PID:3740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7937.exe
      4⤵
      PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39495.exe
        5⤵
        
        PID:7116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60642.exe
        6⤵
        
        PID:16116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24033.exe
        6⤵
        
        PID:2248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19176.exe
        5⤵
        
        PID:8868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49326.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7162.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56521.exe
      4⤵
      PID:7564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20436.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29129.exe
      4⤵
      PID:12104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
      4⤵
      PID:912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26111.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26111.exe
    3⤵
    PID:5560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52674.exe
      4⤵
      PID:8808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13357.exe
      4⤵
      PID:11896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30465.exe
      4⤵
      PID:6680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31240.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31240.exe
    3⤵
    PID:7348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62482.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62482.exe
    3⤵
    PID:11300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14183.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14183.exe
    3⤵
    PID:16128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64443.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64443.exe
    3⤵
    PID:10496
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50782.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50782.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30098.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30098.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32631.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64343.exe
        5⤵
        
        PID:392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10568.exe
        6⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23282.exe
        7⤵
        
        PID:8740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        7⤵
        
        PID:13756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24033.exe
        7⤵
        
        PID:3876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23108.exe
        6⤵
        
        PID:9176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34878.exe
        6⤵
        
        PID:12408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37924.exe
        6⤵
        
        PID:16712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64569.exe
        5⤵
        
        PID:6524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11014.exe
        6⤵
        
        PID:10744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37984.exe
        6⤵
        
        PID:16328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23697.exe
        6⤵
        
        PID:8576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3679.exe
        5⤵
        
        PID:7876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36207.exe
        5⤵
        
        PID:10268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20803.exe
        5⤵
        
        PID:2776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1800.exe
      4⤵
      PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9089.exe
        5⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39495.exe
        6⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe
        7⤵
        
        PID:12592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32363.exe
        7⤵
        
        PID:8572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4568.exe
        6⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10196.exe
        6⤵
        
        PID:14104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53906.exe
        6⤵
        
        PID:4008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56521.exe
        5⤵
        
        PID:7572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20802.exe
        6⤵
        
        PID:11368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56233.exe
        6⤵
        
        PID:15084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50578.exe
        6⤵
        
        PID:6964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20436.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29129.exe
        5⤵
        
        PID:13568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4698.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21812.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51714.exe
        5⤵
        
        PID:9156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28745.exe
        5⤵
        
        PID:14376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21041.exe
        5⤵
        
        PID:10956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12424.exe
      4⤵
      PID:9328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7926.exe
      4⤵
      PID:14144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16377.exe
      4⤵
      PID:10592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22660.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22660.exe
    3⤵
    PID:4960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9089.exe
      4⤵
      PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16551.exe
        5⤵
        
        PID:8172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27752.exe
        5⤵
        
        PID:944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40389.exe
        5⤵
        
        PID:16056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
        5⤵
        
        PID:15308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12232.exe
      4⤵
      PID:7500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14065.exe
        5⤵
        
        PID:11132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60649.exe
        5⤵
        
        PID:14516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29899.exe
        5⤵
        
        PID:15460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52165.exe
      4⤵
      PID:10796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6072.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7162.exe
      4⤵
      PID:8612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27678.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27678.exe
    3⤵
    PID:5464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13281.exe
      4⤵
      PID:9924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4136.exe
      4⤵
      PID:14036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56706.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32216.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32216.exe
    3⤵
    PID:7304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49239.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49239.exe
    3⤵
    PID:13024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59474.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59474.exe
    3⤵
    PID:5976
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37311.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37311.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18023.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18023.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47927.exe
      4⤵
      PID:5188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47175.exe
        5⤵
        
        PID:6268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51170.exe
        6⤵
        
        PID:11280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37592.exe
        6⤵
        
        PID:14228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22846.exe
        6⤵
        
        PID:11804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10541.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe
        5⤵
        
        PID:14468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7162.exe
        5⤵
        
        PID:8292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51913.exe
      4⤵
      PID:6484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30594.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        5⤵
        
        PID:13104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62571.exe
        5⤵
        
        PID:1144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13140.exe
      4⤵
      PID:11904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43912.exe
      4⤵
      PID:15416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5251.exe
      4⤵
      PID:16720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60345.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60345.exe
    3⤵
    PID:5940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52482.exe
      4⤵
      PID:8040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39008.exe
      4⤵
      PID:6976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53906.exe
      4⤵
      PID:4312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9268.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9268.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22958.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22958.exe
    3⤵
    PID:11560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37908.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37908.exe
    3⤵
    PID:11032
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64809.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64809.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63090.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63090.exe
    3⤵
    PID:4416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58695.exe
      4⤵
      PID:6116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52482.exe
        5⤵
        
        PID:8896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54183.exe
        6⤵
        
        PID:12140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39493.exe
        6⤵
        
        PID:208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52937.exe
        5⤵
        
        PID:11912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21041.exe
        5⤵
        
        PID:9984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13597.exe
      4⤵
      PID:8308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30927.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37370.exe
      4⤵
      PID:432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16712.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16712.exe
    3⤵
    PID:6308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3281.exe
      4⤵
      PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14893.exe
      4⤵
      PID:12524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44830.exe
      4⤵
      PID:2728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53922.exe
      4⤵
      PID:3912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57417.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57417.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11620.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11620.exe
    3⤵
    PID:12496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37924.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37924.exe
    3⤵
    PID:16696
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59895.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59895.exe
  2⤵
  PID:5580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15073.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15073.exe
    3⤵
    PID:6744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38274.exe
      4⤵
      PID:8972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17887.exe
      4⤵
      PID:13688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56443.exe
      4⤵
      PID:16828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17640.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17640.exe
    3⤵
    PID:10228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18063.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18063.exe
    3⤵
    PID:14004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
    3⤵
    PID:14056
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13399.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13399.exe
  2⤵
  PID:6020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20802.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20802.exe
    3⤵
    PID:11380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56233.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56233.exe
    3⤵
    PID:14952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22846.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22846.exe
    3⤵
    PID:11780
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39541.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39541.exe
  2⤵
  PID:10580
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63865.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63865.exe
  2⤵
  PID:13632
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52275.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52275.exe
  2⤵
  PID:5660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5476 -ip 5476
1⤵
PID:7432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 6976 -ip 6976
1⤵
PID:10124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 13552 -ip 13552
1⤵
PID:16304

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1158.exe

Filesize
468KB

MD5
cc4af436ec716fa60aeb49ba58957bee

SHA1
c04e947261182c158c821a40dba9fb902bfd72cc

SHA256
00cde5004f1434d0e493c51dc7a9d4e6fd9d96539f855ed5856142575568f2fa

SHA512
cb8fda135d7b2b9f9d51fd4c8a1ef8a08f16ee65ec96954191a58f44a8308fb830c2d18e9dfc30ca12cf4ba3d6eb3554e5c67ca8ac9467197a4ec0609eb0458a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14737.exe

Filesize
468KB

MD5
d608ccce96a66fbbf3d07b4834ee95a7

SHA1
cf3a314d16983268bcb083744548c4b5a24e7758

SHA256
088a93a830f1abbc41bc5469dfb30a7d02913bd1fecfb29150b858679252003d

SHA512
a8a8d8163c74c8be2e5246f46f0088d214f105b2781a1f55f65023f0eb232c64f1e843e640dbe51660612e5b98aa1e8b09b69675d8bac122ac3df5e5794e44cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14845.exe

Filesize
468KB

MD5
bab964755de5c80d36304f0b91875868

SHA1
f47ef594a3d9db593f7cb3fdd905814eb2ec4297

SHA256
0f1a8c924fdd6dc68f21292bb75efe765bf1f7cee11767d7c6e3f7bbc6742d24

SHA512
07cce133e6d6db26af2e52d47c542c32cf21c183a1123eddfadb778919ed2862602ae67c5788c753437b4c6ea880609b2f9dca1b6fe3ad64c560a043e628fec4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15421.exe

Filesize
468KB

MD5
926675eaec85d16307e60db7a323620b

SHA1
e34c3b9d76f60c791d7cd79ff275ae47d431ef97

SHA256
7385026d9de0f72d180a007f93c1a9e81ea505738708fb5d38648840a9dc81a8

SHA512
f0f5aab5ebe8887ddbac7ade480f59e5aaff91891b3d2fe77f36a46999cf76680bd86edff5492ceea7ad81accd0dcb9b643cb4639f696dbf30fd58e61652ff52

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15821.exe

Filesize
468KB

MD5
b7bd13ed4b3f2de37aa98591e7d49255

SHA1
8ba892b6bfba0cfa59ef1ce0aea0d2f9ca9325fa

SHA256
30de4a641ce147ee25475705d425d4f799d129e298639228e2ec50f795bc8b7c

SHA512
1f3208699bfa5f4b7c491ff0239f9f69bc6fae7c278b311e54412b37560d179247a0f4b926d3f2d7e87e07c8b7c3851e999ae04ad60a8944321fbeded0e9bb88

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16765.exe

Filesize
468KB

MD5
e06718837acaf50165c8e08590a49627

SHA1
46523ce23c3140372b216ebec76a3f16cee0431a

SHA256
6e3da264361f20b30b3509e1e6befce31fd4aa773086d6e4064016c8d3d70146

SHA512
72ff3a7b62c2214f19ae5276f89368abbb7aa18253065789632104272fb795d8567dc181987ce4652d2401fe1cf5f00f4f0d8b7d4d9dbbe094abd3c660119141

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17640.exe

Filesize
468KB

MD5
4831cf19f882954bdf36355812717d43

SHA1
b2eb9ba874d426906d941cde3ca65457e5c7de8f

SHA256
a837f7e3e892a9f56a2e2f7bfc4bf9980efdb549eba8b615e0b71c13ebf2b9fa

SHA512
d4deacd16fc94f5ad08c98cc00beeab1be5e426b1916c8b46fd8cb94903556fd2ed355ea716f497a53f466dddeb6a21574c428b6aad2ec145f7ae19be04d414d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19188.exe

Filesize
468KB

MD5
0911c84a26c82c0c42d07f364ef2e027

SHA1
8acc48e113d4269ffbdac456b7154d22417e6509

SHA256
596b70b342cbc125880512662fa1321cf95155454703a97c2cb6fc07f7ce518e

SHA512
c3dd778e08c32d9baa97b8f3ee5886a84ba469b84bc1788e8c879d0db7d242bc8f7178b38dcd781d2db05daa011fb8461704c44427ebcb0dc597d7f1501a97f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20445.exe

Filesize
468KB

MD5
98affb15aa303dc681c11abaa594c7f7

SHA1
a27dac27cb7ec3523fd5a378dd08ea7aea49b2d3

SHA256
88748c6e6b3c127272274f4a27349bd6b36f4b5321f52c7cf80ba792df605b47

SHA512
da1d517e7646d7b26478367f67e0ac7ee979a1b1c14066822d7ef467315a8a3e194845f338eaa13a2b73d5deebe5a64a37255c160e9280ede09ae591c603db72

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20487.exe

Filesize
468KB

MD5
0a97529440f6b228c9129c524e84c25c

SHA1
031ab0351c8c026eac662080c4132ce786157901

SHA256
ac046cf14e43a532b010be0835bd0e6ee6ae374669badd33a68579f1d5e78ff3

SHA512
5a48b26149d2e703b8ef0dfed922ecdd0f6f0bc876113297ded01afdb1778b422404ede33d659fc351c8411b3709e00e186ce03061db0438df055a3ea18020d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23250.exe

Filesize
468KB

MD5
19ead670a55fcdba5272b4a6636abbc5

SHA1
6e5eeb16716d30a73bb52c4c6f8eb8dec120f07d

SHA256
3aa0eab91e3e5e2d5551e0fc2d4d41b03b29fc7b26ae1ff83d458830086c77d2

SHA512
3c8d082924062213f36d77fb83e731b2d99de0f34349844efb2aa2d15a8eae1d90d27ed1cf1618467a6c55ddfb1f302c67386ac7cfd6045d77363fb492f7f8dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23383.exe

Filesize
468KB

MD5
342aed4d97c1739163ffd97239204a0b

SHA1
50dc7af858f6a1456eb16c2fd371f267004be749

SHA256
f550f9e5e7fb2323931b264346e683f33bfe76bd6695e62496127c693a874c73

SHA512
08a3b560b8b0c7358576ccd5fa79f366c4114bf9f2063d5caef1f0b8968b6f88097f22b5c11d1827441d031c57c8a1ee6d673c5a21d5a07f56069f17c089a3bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28126.exe

Filesize
468KB

MD5
cc84e4be7171ed7e11f8e54f56a83deb

SHA1
f9957d24700e7aab359ff4eb07be536a7a65c177

SHA256
03225dcbcc41a07d848ebbd9505b064f0dacfbd61b0f141263e9ed2259245175

SHA512
fb33c0def675b7bafdfd28cc4ebed3fadf943c8fe3e1bb5d57d2a826bfc8273cc416fa7a8fdca5e4f0fd344b85868618cafdc4641f218b84cee80a157590804a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28391.exe

Filesize
468KB

MD5
989f81cce4d3404e1d8f34778b81c0cc

SHA1
8a234cda3d3993c8f44a125bb64cbd9ff5732b3e

SHA256
e03f6e359fefd4f98448e9fbc1fd80cd6b5fa0bbc61bbac068f1db9c563c6ec0

SHA512
ca82567e0b8a4204b924b5c5f5db47278d74453b93b59d3129cecbc1633f5f68097f4e6382a38f739d5ee51ea908f4ff9e7731c0fd8b25b70a57079a778d93bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28580.exe

Filesize
468KB

MD5
2f6598a049938d67a334bc78fc14981e

SHA1
2974215922ab65063d3a00c5baf18ae56941e41b

SHA256
db3cdd82f79461a086b7fcfd88a42899ec45ddc09db46c27455e81ebe3967801

SHA512
70bc343adf3f8f0fa50033d249a550666a64ae9cb925a99e9c303bb171c87faa17ca056565f4b04fe78ac756dd4e0caf6fb2e5365d26c682cf974009dd5383a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30098.exe

Filesize
468KB

MD5
8979a164c718ba43323e522e2d03ecdb

SHA1
ba9fa84d2fbcd183a844e8c9b1d5e5c45490ef12

SHA256
eda375669a829936a9b36248173756bafb02f30083a54d1fd4c8ff3a86238d9a

SHA512
1ff11c29d18316cc34e83f66a84b281d0a17deafe38342531a504d88376816b53cd239c4441414b8235f38aeb0116fe8c8eee495e0315176176bb53e11d193b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30301.exe

Filesize
468KB

MD5
dbeb84c5727b2699611875e69803d353

SHA1
1414939278c494f82064c7a196f1d2da7c029a06

SHA256
843ffe5758038856370d8b61108b94ca8d20fe5f827b169c1a311b312c0dc37e

SHA512
6d868dc2ce3cbedeb791b8d5a37bf507bf1946dbf21f9f8afa9813fd59f35fc4771673a6bf7635e480f300797288da0954944ef4ad0dd8c374f8878f87730a3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30500.exe

Filesize
468KB

MD5
ec8688b32eb760867c1e612d54842510

SHA1
e64180982a7abdcaff09fcbd4b537c0e03de2310

SHA256
b3715084629e10d7cea6401ec5749b6dff035fa43b5142e22113d9052a110000

SHA512
14947c4ba008c019a074877fb202a9b2da6a6cf82eb8b1dbefcbfeb0d47fc90420a6edfe92ef79f8e618977851a43b768d34c145ba36b4eb83393109c92d508d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33375.exe

Filesize
468KB

MD5
c108634aadebec847181c2197b6bc11e

SHA1
57c949d0d607e74b4596a8adff815b6d9786115c

SHA256
c0d91ade5e44d1dcfab1f6fa2749fc16f8564481014b0ebe3549ce3cc64e3ea8

SHA512
771ab282465fabdf4c262326f865c7b73deac35700ba4d39ddacd1d76a0b08ad9ae1556a4845e6aa034ff3dc1af349889bcfe81f1f6ffc05043364f9b674d5d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33431.exe

Filesize
468KB

MD5
36a35771a284ef9507c296bfb99ba91a

SHA1
c0b8b8063d2bd82a93bfdce53a4d468fefcf95e2

SHA256
054bc155b00b7bc7a9a98aea43b45cd79f03b2bb5766f0eb516769614f33fa2f

SHA512
87bdcf61e8be3435bdda2cba62b47d3256ab6f6326d3df8010cf388bf6b3c028844d8050f572b47b3c31d5e6648753a53b199c57123334bc601bab72281aaf7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34711.exe

Filesize
468KB

MD5
092139953474804987eba4f3ed4d6ff0

SHA1
2bc0f60742d6e560c4974d41b02dda2085056521

SHA256
093657f46fb9659911a88fddeb4a8160a3d512c5408b27cb40321f35e8408f1f

SHA512
5ab66bccafd64e05923258aeafc72026db587c64186da6d6cae4f541e00b462ea69685689f0744aa45294587df240876cbc0b34fb438e1ea7c1ad4de4b553a71

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3517.exe

Filesize
468KB

MD5
4d7c32fdd787b379cc1d65bd56a67429

SHA1
deae331cb3381ba5221be473ad3dae9c195cb7f5

SHA256
eb0921b69518cb1f341433d9d4b53baf64e535cf6c6256be991db50d09acdff0

SHA512
79d41b3dc91ddc0ce28d18f243736d5ef9ae9c3519acd98c16f588313995738bbe23775fe1e1eb8b7b6c7f96c961423097aec0f137fb273f923f0d1fbf2c7480

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37311.exe

Filesize
468KB

MD5
69d18761e30be581ffc0c5c506a55fa3

SHA1
26ccf38c00914d27726ad8cc1525749ad7d3bb03

SHA256
bad50e7be03bcc7c0fd383548131628aa9371fbce36e29b15fff7911b3c2f4b0

SHA512
38e0451c15053b1c4bd38c9146b1938335db4baffd3b1f326138310347d4e1f68a7715471ee26e65cd630776355316933bac28d8b79ac433f847a0131d0d73d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40128.exe

Filesize
468KB

MD5
1a330dd4b69c07ab593e5e523330149c

SHA1
f3d9e31b4dbbe3d30006d06bd7fbfa3bece0719e

SHA256
69e7c568f80f667a62d2c72821995e74e9d8d69d93563ee97c3f1395885232cc

SHA512
3eee8944876ee1d1168c9f0aa243cc9e0400349566735718d385cc5301a96468ac1bcf25ab79e56355e42ee57e9f550b2d823d2843dc5be1cd80d0482e9eddea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe

Filesize
468KB

MD5
c3d5182ae573eb98d4d6dd075a380ded

SHA1
e9b454bd227d444cb4784357f437fde94958b35f

SHA256
f21854918ee104bf69f7144a3d68daeea3d7dff0f6c369119f0c11c409730f96

SHA512
6d9c9f69ebdbbfd08f27e4c5fbf8a6653f543f9312f60f0708c88a3cc4c281d96a38334a6b36f6e5f18c3a25852cf9eb1f84022a6d6112caea78b4dbab9dd46b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50782.exe

Filesize
468KB

MD5
257a47f9c6c3118dcf276ebff91827c7

SHA1
78960fd30bd0593e47b0ff8ccaa68748c78fea49

SHA256
4953aec854b13425790067641fbb3b5ec0de4824405f893bcf54eb7e9262aa3e

SHA512
0efae323f1d532b1b60ec96fb0f14fcd08435c716e3969d3399cc9389a79f63604c271aa5feade4eb55787d1eff62e9328fbf4f0f9d6cbabdc46243dcdb1bfc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51431.exe

Filesize
468KB

MD5
d4d500f882c83f141bc5f5feb506e9d3

SHA1
2505c4ae07a22e34b00484680b1f6c69034a8d63

SHA256
7083adf8a78581577852f9c3c711a9ae5ea9b7a408bdb6288618d8927e11ead2

SHA512
39d3733a2005093c92e01d9f0c1b83344f9b7be0672e8ab7d1d4d99362d93b2771a6dbc0a04f708b498078c6bddf6ab3f52f0d01d60e11e893dcbd1614b71ee5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51815.exe

Filesize
468KB

MD5
7096fa1f05fcda2bad83b73b6127fd9e

SHA1
46b4811a95d5a3d02cfb39f1b650456add9d2bb1

SHA256
b28f99f1f5863f04300bfdc79d8cb1fd865b3d4497ca3a8319f23e4d6c60ad14

SHA512
5964545982036e4b73eceb3f33472698df3587cb35e23cd1863e78d5383da5eaf3eb657b82c0d097b942f3029acc848688a11e1f79cbd5c2c2b173965b5f29ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-532.exe

Filesize
468KB

MD5
ce4830607683c9618ed0995968565a86

SHA1
65e7bc8a8ac154bb35918d0528fa8e227febfe35

SHA256
e15e935d474577a8656f428d53aad4a690b6236f8d6ffa6b9c9e25c76f2a9099

SHA512
ddf29019f3c810ba07dd454d0496ee7b141d404eed5d82bd814a7ffa45b61f45e9b0e6c0e1fdfee0494d29991ce8ec0d1931404ddf19c5eceac0b658634928d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55687.exe

Filesize
468KB

MD5
e01332028d9b9cb1fd1c23735f13da12

SHA1
c71d53f6ec32558b628f885cb59aecd633690492

SHA256
52ee47477cfe3244b309a7efe88f838655e60aa60a06c6378d68c365f22a08a4

SHA512
16fc8bf27c804288376d81e9b359f8b6930e3bae314413fb50b310d83b5da9b52556de2779ed87d073504aee28d01fd6345ffdc6481299f11135e15c02437063

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56055.exe

Filesize
468KB

MD5
e22e17a16e5a2995c86a1581a2b29a20

SHA1
bd9c8d762f1c578258d2270fe352b285890b70c0

SHA256
06f22bb93fc5a09473be64f248b6be1b54e9da8a669e3858eaa8536e1ba9fb56

SHA512
4845da782bc236859ed2fb9fda83215fae81771dcdc55ad6a4382d0e5065127c2443a89fee4460d9d759e7e80840288c26b32847ae34c175f10f5ce2084c4991

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57024.exe

Filesize
468KB

MD5
33bbe84ecb49eee5b8c3d4c24877744e

SHA1
93b7d249d61a51e1eafaac4ef6e2ae2cdd0c5516

SHA256
844196ac3d7c2ef39914215b407f05c0f4024bdb195dec9eddef86e571ecd7a9

SHA512
2a42c61a748470674954286acfe1f9f944933a372e96016d8af48f42b924a7360b3448550e6f0969dd4634312dc963378ab53cbbdc249db68e0530143a890fe5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60466.exe

Filesize
468KB

MD5
ebbae8a3b1b648123a35e5dd4fa3b760

SHA1
a9803700f7aa9b840580fa36fc4e738b0fda7586

SHA256
deb28664a9c355448189a95701b64311ebd65bbc12493a831cb743b8fade21fc

SHA512
3fd2e79d8127946c7c06c3fcf1ec0851b5ca0e310623f8daef706cb0cc078ec1e47652350fcd6766ee0d901e0ba694b895e808f97108582bc8cf463db0653627

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8525.exe

Filesize
468KB

MD5
e76ebce2d564dab9be61e9cec59edd50

SHA1
a074edb7b6e1c46b791b70010cad4f18b24c6ef1

SHA256
8d0513f808ff12b6ed9df6da62a65648aefb8ec4f6a50770974730b4d70dd63d

SHA512
9667b3383025ede57847759d2d549f6fe557a6b47548b941106fb46e0131d3d29651d9d99670aeba36fb9b30713b1dafe6df16930a75a14821470c61ecda3fd9

Download Submit
memory/8-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/112-43-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/364-293-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/392-414-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/404-258-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/424-191-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/712-429-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1180-104-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1204-374-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1296-324-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1372-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1504-489-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1588-236-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1640-364-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1644-353-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1688-469-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1700-398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1744-128-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1796-189-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1848-2657-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1852-30-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1856-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1864-179-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1920-399-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1992-476-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1996-403-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2060-379-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2276-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2288-448-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2372-2550-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2408-229-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2412-297-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2612-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2628-470-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2728-2755-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2732-296-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2804-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2832-325-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2876-42-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2976-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3184-479-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3304-252-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3364-449-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3384-68-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3388-185-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3392-354-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3528-420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3568-471-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3600-183-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3604-228-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3612-430-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3616-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3792-89-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3852-136-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3880-91-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3936-127-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3976-283-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4052-291-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4196-215-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4216-410-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4248-92-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4292-259-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4300-356-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4320-198-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4348-502-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4372-203-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4408-220-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4416-459-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4432-298-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4472-373-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4496-61-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4548-442-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4616-241-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4696-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4708-169-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4756-135-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4840-352-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4860-53-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4896-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4916-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4960-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4984-90-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5016-181-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5064-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5104-467-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5144-519-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5176-520-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5200-521-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5212-526-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5264-560-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5284-543-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5336-544-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5388-563-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5468-564-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5476-553-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5580-587-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5680-588-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5700-590-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5708-589-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/13892-2754-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15744-2724-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16092-2637-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16148-2542-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads