09f753a0fdbe6058758bb6a0e3509b82da7c8a526c1c3de851937b8b0467902f

Analysis

max time kernel
150s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 18:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09f753a0fdbe6058758bb6a0e3509b82da7c8a526c1c3de851937b8b0467902f.exe
Size

468KB
MD5

f26660c688a9972ca35f08fbddd20215
SHA1

5973a7243edc6dcaebfa2fe5edc8d1fc6b56d62d
SHA256

09f753a0fdbe6058758bb6a0e3509b82da7c8a526c1c3de851937b8b0467902f
SHA512

439a39032856ffdd64647b782be6a591a695027b698bc2c3dacfebe8ff0955633e923c220df96606609c2a2ad623eb8d7079f436e34bb442269623e9c09c1929
SSDEEP

3072:1btZogI7Ia5VtbYuPzsjnm8VEDhDEFpCwmHekO5ATDoLnFnu5ela:1broaeVtpPojnmED/STDSFnu5

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4396	Unicorn-55391.exe
3968	Unicorn-7342.exe
4924	Unicorn-57098.exe
4004	Unicorn-34622.exe
1656	Unicorn-54488.exe
3712	Unicorn-41167.exe
2548	Unicorn-12478.exe
1976	Unicorn-26523.exe
5108	Unicorn-63371.exe
3740	Unicorn-8048.exe
5088	Unicorn-12132.exe
2732	Unicorn-57804.exe
4472	Unicorn-42859.exe
3616	Unicorn-46678.exe
1432	Unicorn-435.exe
3776	Unicorn-61416.exe
3552	Unicorn-57887.exe
2176	Unicorn-42449.exe
1588	Unicorn-46268.exe
3668	Unicorn-46533.exe
3048	Unicorn-11722.exe
2040	Unicorn-22997.exe
3612	Unicorn-64907.exe
8	Unicorn-62107.exe
4272	Unicorn-5500.exe
780	Unicorn-5500.exe
4400	Unicorn-51172.exe
2168	Unicorn-5500.exe
3420	Unicorn-13367.exe
1984	Unicorn-45718.exe
2268	Unicorn-10252.exe
888	Unicorn-16383.exe
1480	Unicorn-52324.exe
3756	Unicorn-4606.exe
3124	Unicorn-4606.exe
868	Unicorn-62760.exe
4116	Unicorn-27649.exe
1808	Unicorn-46678.exe
4480	Unicorn-20035.exe
1660	Unicorn-1006.exe
3572	Unicorn-13258.exe
1624	Unicorn-13258.exe
3704	Unicorn-23464.exe
2520	Unicorn-33679.exe
1172	Unicorn-6274.exe
2500	Unicorn-15204.exe
3216	Unicorn-15204.exe
4452	Unicorn-15204.exe
4484	Unicorn-50015.exe
3284	Unicorn-23108.exe
940	Unicorn-60876.exe
1792	Unicorn-7591.exe
4596	Unicorn-7591.exe
2480	Unicorn-7591.exe
976	Unicorn-1991.exe
2376	Unicorn-44597.exe
1452	Unicorn-24333.exe
1600	Unicorn-12635.exe
1864	Unicorn-32501.exe
3736	Unicorn-63227.exe
4868	Unicorn-1774.exe
3296	Unicorn-5593.exe
4044	Unicorn-65265.exe
2188	Unicorn-51530.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
7132	6056	WerFault.exe	216
14724	13012	WerFault.exe	609
14756	13012	WerFault.exe	609
16980	15252	WerFault.exe	726

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63227.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14876.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24826.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1991.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19160.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38634.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21557.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37675.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18252.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15854.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7591.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40088.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37923.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11857.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36361.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64924.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21513.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52475.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36689.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4893.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5557.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45961.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20927.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21737.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61965.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12904.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44341.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37953.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35407.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41244.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21945.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33485.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13420.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57065.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29842.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61297.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19680.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33338.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42395.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60082.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19044.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64065.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52482.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58539.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8458.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41845.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7591.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58847.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32596.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62314.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16075.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 26 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17044	dwm.exe
Token: SeChangeNotifyPrivilege	17044	dwm.exe
Token: 33	17044	dwm.exe
Token: SeIncBasePriorityPrivilege	17044	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4000	09f753a0fdbe6058758bb6a0e3509b82da7c8a526c1c3de851937b8b0467902f.exe
4396	Unicorn-55391.exe
3968	Unicorn-7342.exe
4924	Unicorn-57098.exe
4004	Unicorn-34622.exe
1656	Unicorn-54488.exe
2548	Unicorn-12478.exe
3712	Unicorn-41167.exe
1976	Unicorn-26523.exe
5108	Unicorn-63371.exe
1432	Unicorn-435.exe
3740	Unicorn-8048.exe
5088	Unicorn-12132.exe
2732	Unicorn-57804.exe
3616	Unicorn-46678.exe
4472	Unicorn-42859.exe
3776	Unicorn-61416.exe
3552	Unicorn-57887.exe
2176	Unicorn-42449.exe
3668	Unicorn-46533.exe
1588	Unicorn-46268.exe
3612	Unicorn-64907.exe
3048	Unicorn-11722.exe
4400	Unicorn-51172.exe
2168	Unicorn-5500.exe
780	Unicorn-5500.exe
8	Unicorn-62107.exe
2040	Unicorn-22997.exe
4272	Unicorn-5500.exe
3420	Unicorn-13367.exe
1984	Unicorn-45718.exe
2268	Unicorn-10252.exe
888	Unicorn-16383.exe
1480	Unicorn-52324.exe
3756	Unicorn-4606.exe
3124	Unicorn-4606.exe
868	Unicorn-62760.exe
4116	Unicorn-27649.exe
1808	Unicorn-46678.exe
3572	Unicorn-13258.exe
1660	Unicorn-1006.exe
4480	Unicorn-20035.exe
1624	Unicorn-13258.exe
2520	Unicorn-33679.exe
3704	Unicorn-23464.exe
1172	Unicorn-6274.exe
3216	Unicorn-15204.exe
2500	Unicorn-15204.exe
4452	Unicorn-15204.exe
3284	Unicorn-23108.exe
940	Unicorn-60876.exe
4596	Unicorn-7591.exe
976	Unicorn-1991.exe
1792	Unicorn-7591.exe
2480	Unicorn-7591.exe
2376	Unicorn-44597.exe
4484	Unicorn-50015.exe
1452	Unicorn-24333.exe
1600	Unicorn-12635.exe
3736	Unicorn-63227.exe
1864	Unicorn-32501.exe
4868	Unicorn-1774.exe
2188	Unicorn-51530.exe
4044	Unicorn-65265.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4000 wrote to memory of 4396	4000	09f753a0fdbe6058758bb6a0e3509b82da7c8a526c1c3de851937b8b0467902f.exe	82
PID 4000 wrote to memory of 4396	4000	09f753a0fdbe6058758bb6a0e3509b82da7c8a526c1c3de851937b8b0467902f.exe	82
PID 4000 wrote to memory of 4396	4000	09f753a0fdbe6058758bb6a0e3509b82da7c8a526c1c3de851937b8b0467902f.exe	82
PID 4396 wrote to memory of 3968	4396	Unicorn-55391.exe	83
PID 4396 wrote to memory of 3968	4396	Unicorn-55391.exe	83
PID 4396 wrote to memory of 3968	4396	Unicorn-55391.exe	83
PID 4000 wrote to memory of 4924	4000	09f753a0fdbe6058758bb6a0e3509b82da7c8a526c1c3de851937b8b0467902f.exe	84
PID 4000 wrote to memory of 4924	4000	09f753a0fdbe6058758bb6a0e3509b82da7c8a526c1c3de851937b8b0467902f.exe	84
PID 4000 wrote to memory of 4924	4000	09f753a0fdbe6058758bb6a0e3509b82da7c8a526c1c3de851937b8b0467902f.exe	84
PID 4396 wrote to memory of 4004	4396	Unicorn-55391.exe	85
PID 4396 wrote to memory of 4004	4396	Unicorn-55391.exe	85
PID 4396 wrote to memory of 4004	4396	Unicorn-55391.exe	85
PID 3968 wrote to memory of 1656	3968	Unicorn-7342.exe	86
PID 3968 wrote to memory of 1656	3968	Unicorn-7342.exe	86
PID 3968 wrote to memory of 1656	3968	Unicorn-7342.exe	86
PID 4924 wrote to memory of 3712	4924	Unicorn-57098.exe	87
PID 4924 wrote to memory of 3712	4924	Unicorn-57098.exe	87
PID 4924 wrote to memory of 3712	4924	Unicorn-57098.exe	87
PID 4000 wrote to memory of 2548	4000	09f753a0fdbe6058758bb6a0e3509b82da7c8a526c1c3de851937b8b0467902f.exe	88
PID 4000 wrote to memory of 2548	4000	09f753a0fdbe6058758bb6a0e3509b82da7c8a526c1c3de851937b8b0467902f.exe	88
PID 4000 wrote to memory of 2548	4000	09f753a0fdbe6058758bb6a0e3509b82da7c8a526c1c3de851937b8b0467902f.exe	88
PID 4004 wrote to memory of 1976	4004	Unicorn-34622.exe	89
PID 4004 wrote to memory of 1976	4004	Unicorn-34622.exe	89
PID 4004 wrote to memory of 1976	4004	Unicorn-34622.exe	89
PID 4396 wrote to memory of 5108	4396	Unicorn-55391.exe	90
PID 4396 wrote to memory of 5108	4396	Unicorn-55391.exe	90
PID 4396 wrote to memory of 5108	4396	Unicorn-55391.exe	90
PID 1656 wrote to memory of 3740	1656	Unicorn-54488.exe	91
PID 1656 wrote to memory of 3740	1656	Unicorn-54488.exe	91
PID 1656 wrote to memory of 3740	1656	Unicorn-54488.exe	91
PID 2548 wrote to memory of 5088	2548	Unicorn-12478.exe	92
PID 2548 wrote to memory of 5088	2548	Unicorn-12478.exe	92
PID 2548 wrote to memory of 5088	2548	Unicorn-12478.exe	92
PID 3968 wrote to memory of 2732	3968	Unicorn-7342.exe	93
PID 3968 wrote to memory of 2732	3968	Unicorn-7342.exe	93
PID 3968 wrote to memory of 2732	3968	Unicorn-7342.exe	93
PID 3712 wrote to memory of 4472	3712	Unicorn-41167.exe	94
PID 3712 wrote to memory of 4472	3712	Unicorn-41167.exe	94
PID 3712 wrote to memory of 4472	3712	Unicorn-41167.exe	94
PID 4000 wrote to memory of 3616	4000	09f753a0fdbe6058758bb6a0e3509b82da7c8a526c1c3de851937b8b0467902f.exe	95
PID 4000 wrote to memory of 3616	4000	09f753a0fdbe6058758bb6a0e3509b82da7c8a526c1c3de851937b8b0467902f.exe	95
PID 4000 wrote to memory of 3616	4000	09f753a0fdbe6058758bb6a0e3509b82da7c8a526c1c3de851937b8b0467902f.exe	95
PID 4924 wrote to memory of 1432	4924	Unicorn-57098.exe	96
PID 4924 wrote to memory of 1432	4924	Unicorn-57098.exe	96
PID 4924 wrote to memory of 1432	4924	Unicorn-57098.exe	96
PID 1976 wrote to memory of 3776	1976	Unicorn-26523.exe	97
PID 1976 wrote to memory of 3776	1976	Unicorn-26523.exe	97
PID 1976 wrote to memory of 3776	1976	Unicorn-26523.exe	97
PID 4004 wrote to memory of 3552	4004	Unicorn-34622.exe	98
PID 4004 wrote to memory of 3552	4004	Unicorn-34622.exe	98
PID 4004 wrote to memory of 3552	4004	Unicorn-34622.exe	98
PID 5108 wrote to memory of 2176	5108	Unicorn-63371.exe	101
PID 5108 wrote to memory of 2176	5108	Unicorn-63371.exe	101
PID 5108 wrote to memory of 2176	5108	Unicorn-63371.exe	101
PID 4396 wrote to memory of 1588	4396	Unicorn-55391.exe	102
PID 4396 wrote to memory of 1588	4396	Unicorn-55391.exe	102
PID 4396 wrote to memory of 1588	4396	Unicorn-55391.exe	102
PID 1432 wrote to memory of 3668	1432	Unicorn-435.exe	103
PID 1432 wrote to memory of 3668	1432	Unicorn-435.exe	103
PID 1432 wrote to memory of 3668	1432	Unicorn-435.exe	103
PID 3740 wrote to memory of 3048	3740	Unicorn-8048.exe	104
PID 3740 wrote to memory of 3048	3740	Unicorn-8048.exe	104
PID 3740 wrote to memory of 3048	3740	Unicorn-8048.exe	104
PID 4924 wrote to memory of 2040	4924	Unicorn-57098.exe	105

C:\Users\Admin\AppData\Local\Temp\09f753a0fdbe6058758bb6a0e3509b82da7c8a526c1c3de851937b8b0467902f.exe
"C:\Users\Admin\AppData\Local\Temp\09f753a0fdbe6058758bb6a0e3509b82da7c8a526c1c3de851937b8b0467902f.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55391.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55391.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7342.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7342.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54488.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8048.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11722.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15204.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15672.exe
        8⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52641.exe
        9⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8458.exe
        10⤵
        
        PID:9452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57524.exe
        10⤵
        
        PID:13668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21272.exe
        10⤵
        
        PID:17380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38747.exe
        10⤵
        
        PID:11368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42340.exe
        9⤵
        
        PID:11856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42126.exe
        9⤵
        
        PID:16096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63157.exe
        9⤵
        
        PID:11684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33927.exe
        8⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61994.exe
        9⤵
        
        PID:16264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17616.exe
        8⤵
        
        PID:10616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19680.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44399.exe
        7⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23150.exe
        8⤵
        
        PID:8248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35096.exe
        9⤵
        
        PID:12408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22139.exe
        9⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49085.exe
        8⤵
        
        PID:13048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42587.exe
        8⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10715.exe
        7⤵
        
        PID:9740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46477.exe
        7⤵
        
        PID:14004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30612.exe
        7⤵
        
        PID:9352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7591.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39299.exe
        7⤵
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20353.exe
        8⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62833.exe
        9⤵
        
        PID:11164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5425.exe
        9⤵
        
        PID:14852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10707.exe
        9⤵
        
        PID:11820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9719.exe
        8⤵
        
        PID:10528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29767.exe
        8⤵
        
        PID:15768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20610.exe
        7⤵
        
        PID:8380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13420.exe
        7⤵
        
        PID:12488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33338.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16640.exe
        6⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36689.exe
        7⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37753.exe
        8⤵
        
        PID:10656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57065.exe
        8⤵
        
        PID:15624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59908.exe
        8⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36361.exe
        7⤵
        
        PID:10548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5263.exe
        7⤵
        
        PID:15632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40257.exe
        7⤵
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe
        6⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32574.exe
        7⤵
        
        PID:12852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56950.exe
        7⤵
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17722.exe
        6⤵
        
        PID:12248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6130.exe
        6⤵
        
        PID:16984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26927.exe
        6⤵
        
        PID:1032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4606.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13834.exe
        6⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50337.exe
        7⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37758.exe
        8⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45454.exe
        9⤵
        
        PID:9376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60110.exe
        9⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13064.exe
        9⤵
        
        PID:11384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5251.exe
        8⤵
        
        PID:9092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56026.exe
        8⤵
        
        PID:14960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46287.exe
        8⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20927.exe
        8⤵
        
        PID:13968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33931.exe
        7⤵
        
        PID:8304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45628.exe
        8⤵
        
        PID:15208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3770.exe
        8⤵
        
        PID:9600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51660.exe
        7⤵
        
        PID:13064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37614.exe
        7⤵
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49251.exe
        6⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8458.exe
        7⤵
        
        PID:9436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46990.exe
        8⤵
        
        PID:10560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16032.exe
        8⤵
        
        PID:15760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28060.exe
        8⤵
        
        PID:10040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44229.exe
        7⤵
        
        PID:11908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55808.exe
        7⤵
        
        PID:16544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25701.exe
        7⤵
        
        PID:9732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62594.exe
        6⤵
        
        PID:8268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22794.exe
        7⤵
        
        PID:1788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10104.exe
        6⤵
        
        PID:14404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27884.exe
        6⤵
        
        PID:5156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17653.exe
        5⤵
        
        PID:1408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56367.exe
        6⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46756.exe
        7⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52209.exe
        7⤵
        
        PID:12436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29961.exe
        7⤵
        
        PID:16836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64264.exe
        7⤵
        
        PID:4900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3205.exe
        6⤵
        
        PID:8684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4320.exe
        7⤵
        
        PID:14896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13420.exe
        6⤵
        
        PID:12388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27308.exe
        6⤵
        
        PID:6900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58127.exe
        5⤵
        
        PID:6344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39019.exe
        6⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64395.exe
        7⤵
        
        PID:10628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57065.exe
        7⤵
        
        PID:15720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36722.exe
        7⤵
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22547.exe
        6⤵
        
        PID:10956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24313.exe
        6⤵
        
        PID:15956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33485.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13444.exe
        5⤵
        
        PID:7660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18252.exe
        5⤵
        
        PID:12256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1665.exe
        5⤵
        
        PID:16964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61179.exe
        5⤵
        
        PID:7164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57804.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5500.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62028.exe
        6⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7166.exe
        7⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37758.exe
        8⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19087.exe
        9⤵
        
        PID:10076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55808.exe
        9⤵
        
        PID:16552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17148.exe
        9⤵
        
        PID:10580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36361.exe
        8⤵
        
        PID:10584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29767.exe
        8⤵
        
        PID:15752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13256.exe
        8⤵
        
        PID:13404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20610.exe
        7⤵
        
        PID:8384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57496.exe
        8⤵
        
        PID:14844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38580.exe
        8⤵
        
        PID:12308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13420.exe
        7⤵
        
        PID:12600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31269.exe
        6⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8292.exe
        7⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15797.exe
        8⤵
        
        PID:9132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16574.exe
        8⤵
        
        PID:14576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18439.exe
        8⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58536.exe
        7⤵
        
        PID:8580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2741.exe
        7⤵
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33926.exe
        7⤵
        
        PID:10020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17810.exe
        6⤵
        
        PID:8284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26770.exe
        7⤵
        
        PID:14860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20490.exe
        7⤵
        
        PID:13876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26459.exe
        6⤵
        
        PID:12980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12921.exe
        6⤵
        
        PID:636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7591.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63803.exe
        6⤵
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22517.exe
        7⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26165.exe
        8⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64924.exe
        8⤵
        
        PID:12928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11668.exe
        8⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20772.exe
        7⤵
        
        PID:9800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38971.exe
        7⤵
        
        PID:14128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12145.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63912.exe
        6⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21998.exe
        7⤵
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50581.exe
        8⤵
        
        PID:11116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5425.exe
        8⤵
        
        PID:16084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5803.exe
        8⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33237.exe
        7⤵
        
        PID:11344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60878.exe
        7⤵
        
        PID:12848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17019.exe
        6⤵
        
        PID:9168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22794.exe
        7⤵
        
        PID:15784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41546.exe
        6⤵
        
        PID:12808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11356.exe
        6⤵
        
        PID:7156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16640.exe
        5⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55163.exe
        6⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46497.exe
        7⤵
        
        PID:11024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14662.exe
        7⤵
        
        PID:16012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57334.exe
        7⤵
        
        PID:7312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35105.exe
        6⤵
        
        PID:11972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12472.exe
        6⤵
        
        PID:16452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38634.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-405.exe
        5⤵
        
        PID:8456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22951.exe
        5⤵
        
        PID:12332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24789.exe
        5⤵
        
        PID:1208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64907.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50015.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6434.exe
        6⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56149.exe
        7⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12350.exe
        8⤵
        
        PID:9040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61416.exe
        8⤵
        
        PID:13216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50563.exe
        8⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35131.exe
        7⤵
        
        PID:8300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23874.exe
        7⤵
        
        PID:15172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63906.exe
        7⤵
        
        PID:11924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59994.exe
        6⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60721.exe
        7⤵
        
        PID:9664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60594.exe
        8⤵
        
        PID:15556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15010.exe
        8⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64706.exe
        7⤵
        
        PID:14452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52918.exe
        7⤵
        
        PID:9192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7611.exe
        6⤵
        
        PID:9596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53008.exe
        6⤵
        
        PID:16424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2446.exe
        6⤵
        
        PID:14116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44399.exe
        5⤵
        
        PID:6540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9527.exe
        6⤵
        
        PID:9412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57524.exe
        6⤵
        
        PID:13636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11668.exe
        6⤵
        
        PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25983.exe
        5⤵
        
        PID:9860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52507.exe
        5⤵
        
        PID:14208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52482.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44597.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39299.exe
        5⤵
        
        PID:4648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37675.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9636.exe
        7⤵
        
        PID:7352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18184.exe
        8⤵
        
        PID:12916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5803.exe
        8⤵
        
        PID:14676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62786.exe
        7⤵
        
        PID:13012
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13012 -s 464
        8⤵
        Program crash
        
        PID:14724
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13012 -s 508
        8⤵
        Program crash
        
        PID:14756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11668.exe
        7⤵
        
        PID:5492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25396.exe
        6⤵
        
        PID:9940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61913.exe
        6⤵
        
        PID:13556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44341.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1255.exe
        5⤵
        
        PID:7832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32133.exe
        6⤵
        
        PID:9084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40201.exe
        6⤵
        
        PID:13040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42614.exe
        5⤵
        
        PID:7420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56738.exe
        5⤵
        
        PID:14200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55738.exe
        5⤵
        
        PID:9620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13840.exe
      4⤵
      PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52594.exe
        5⤵
        
        PID:8436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22385.exe
        6⤵
        
        PID:14904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14876.exe
        5⤵
        
        PID:12124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19339.exe
        5⤵
        
        PID:5892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47185.exe
      4⤵
      PID:7964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2532.exe
        5⤵
        
        PID:10508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5611.exe
        5⤵
        
        PID:1044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18252.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1665.exe
      4⤵
      PID:16992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61179.exe
      4⤵
      PID:3604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34622.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34622.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26523.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61416.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13367.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24333.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7010.exe
        8⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36689.exe
        9⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54691.exe
        10⤵
        
        PID:9432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40201.exe
        10⤵
        
        PID:13036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7007.exe
        10⤵
        
        PID:11780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        9⤵
        
        PID:12888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17194.exe
        9⤵
        
        PID:456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20610.exe
        8⤵
        
        PID:8476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13420.exe
        8⤵
        
        PID:12548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26039.exe
        7⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6071.exe
        8⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25672.exe
        9⤵
        
        PID:9008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32635.exe
        9⤵
        
        PID:12376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11668.exe
        9⤵
        
        PID:14932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60207.exe
        8⤵
        
        PID:9960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59775.exe
        8⤵
        
        PID:13628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58539.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1093.exe
        7⤵
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14784.exe
        8⤵
        
        PID:12100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9887.exe
        8⤵
        
        PID:1328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9061.exe
        7⤵
        
        PID:11800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20207.exe
        7⤵
        
        PID:10148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12635.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63118.exe
        7⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52641.exe
        8⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8458.exe
        9⤵
        
        PID:9460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57524.exe
        9⤵
        
        PID:13660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36173.exe
        9⤵
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42993.exe
        8⤵
        
        PID:9304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30309.exe
        8⤵
        
        PID:14464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15010.exe
        8⤵
        
        PID:13272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33927.exe
        7⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8352.exe
        8⤵
        
        PID:16624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57605.exe
        8⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17616.exe
        7⤵
        
        PID:10924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11512.exe
        7⤵
        
        PID:16256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44207.exe
        6⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38635.exe
        7⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23747.exe
        8⤵
        
        PID:11284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-80.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-80.exe
        8⤵
        
        PID:16288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10295.exe
        7⤵
        
        PID:10804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2824.exe
        7⤵
        
        PID:15996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13614.exe
        7⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38645.exe
        6⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18760.exe
        7⤵
        
        PID:11716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32445.exe
        7⤵
        
        PID:4656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10507.exe
        6⤵
        
        PID:12688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50933.exe
        6⤵
        
        PID:10220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45718.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32501.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39491.exe
        7⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46419.exe
        8⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55407.exe
        9⤵
        
        PID:14068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61689.exe
        9⤵
        
        PID:1272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3113.exe
        8⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9457.exe
        8⤵
        
        PID:16388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16075.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27705.exe
        7⤵
        
        PID:8080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62348.exe
        8⤵
        
        PID:14808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63635.exe
        8⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46973.exe
        7⤵
        
        PID:11336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1206.exe
        7⤵
        
        PID:15220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30471.exe
        6⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37758.exe
        7⤵
        
        PID:568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23171.exe
        8⤵
        
        PID:7432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37137.exe
        8⤵
        
        PID:15204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52508.exe
        8⤵
        
        PID:11984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24606.exe
        7⤵
        
        PID:10928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31331.exe
        7⤵
        
        PID:16936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9508.exe
        6⤵
        
        PID:10768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44861.exe
        6⤵
        
        PID:15792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34664.exe
        6⤵
        
        PID:8244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65265.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47659.exe
        6⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65469.exe
        7⤵
        
        PID:7672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28577.exe
        7⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42514.exe
        7⤵
        
        PID:17192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4392.exe
        7⤵
        
        PID:13792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63476.exe
        6⤵
        
        PID:8540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35430.exe
        7⤵
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14876.exe
        6⤵
        
        PID:12144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2889.exe
        6⤵
        
        PID:10468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20414.exe
        5⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32605.exe
        6⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4094.exe
        7⤵
        
        PID:10896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5508.exe
        7⤵
        
        PID:17136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43215.exe
        7⤵
        
        PID:11192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11857.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5263.exe
        6⤵
        
        PID:15640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64403.exe
        6⤵
        
        PID:11772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24826.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        6⤵
        
        PID:10720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57449.exe
        6⤵
        
        PID:16296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5113.exe
        6⤵
        
        PID:7204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1187.exe
        5⤵
        
        PID:12180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23195.exe
        5⤵
        
        PID:16920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48618.exe
        5⤵
        
        PID:7360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57887.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16383.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63227.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44307.exe
        7⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26383.exe
        8⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63928.exe
        9⤵
        
        PID:9404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40201.exe
        9⤵
        
        PID:13396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48590.exe
        9⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20138.exe
        8⤵
        
        PID:11748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17194.exe
        8⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40341.exe
        7⤵
        
        PID:8416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19536.exe
        8⤵
        
        PID:16732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30962.exe
        8⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28197.exe
        7⤵
        
        PID:12084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33921.exe
        7⤵
        
        PID:7904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26195.exe
        6⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37758.exe
        7⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63928.exe
        8⤵
        
        PID:9340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16574.exe
        8⤵
        
        PID:14492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15175.exe
        8⤵
        
        PID:11768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27809.exe
        7⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50873.exe
        7⤵
        
        PID:15364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51793.exe
        7⤵
        
        PID:11444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56828.exe
        6⤵
        
        PID:10112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31883.exe
        6⤵
        
        PID:14276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51530.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35407.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37758.exe
        7⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19087.exe
        8⤵
        
        PID:408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54543.exe
        8⤵
        
        PID:15076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55590.exe
        8⤵
        
        PID:17068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8404.exe
        8⤵
        
        PID:11100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36361.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5263.exe
        7⤵
        
        PID:15672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49516.exe
        7⤵
        
        PID:12296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15339.exe
        6⤵
        
        PID:9896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9336.exe
        6⤵
        
        PID:12320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45616.exe
        6⤵
        
        PID:13824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64627.exe
        5⤵
        
        PID:6004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40088.exe
        6⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46497.exe
        7⤵
        
        PID:11016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51039.exe
        7⤵
        
        PID:17056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19339.exe
        7⤵
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11861.exe
        6⤵
        
        PID:11832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32596.exe
        6⤵
        
        PID:10492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4135.exe
        5⤵
        
        PID:7540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34328.exe
        6⤵
        
        PID:12208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36530.exe
        6⤵
        
        PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10507.exe
        5⤵
        
        PID:12792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63242.exe
        5⤵
        
        PID:17136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10252.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1774.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44307.exe
        6⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8053.exe
        7⤵
        
        PID:8676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57605.exe
        8⤵
        
        PID:17036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60788.exe
        7⤵
        
        PID:13516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4750.exe
        7⤵
        
        PID:3744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2136.exe
        6⤵
        
        PID:8996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33186.exe
        6⤵
        
        PID:13180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17386.exe
        6⤵
        
        PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34363.exe
        5⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48941.exe
        6⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19087.exe
        7⤵
        
        PID:10208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46375.exe
        7⤵
        
        PID:15100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41050.exe
        7⤵
        
        PID:11476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63581.exe
        6⤵
        
        PID:14508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22674.exe
        6⤵
        
        PID:12872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19458.exe
        5⤵
        
        PID:7756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48718.exe
        6⤵
        
        PID:11784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
        6⤵
        
        PID:7556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26388.exe
        5⤵
        
        PID:12272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22665.exe
        5⤵
        
        PID:16928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59724.exe
        5⤵
        
        PID:6932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5593.exe
      4⤵
      Executes dropped EXE
      PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47659.exe
        5⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52641.exe
        6⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41645.exe
        7⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2327.exe
        7⤵
        
        PID:15004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32881.exe
        7⤵
        
        PID:11332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12350.exe
        6⤵
        
        PID:4680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2741.exe
        6⤵
        
        PID:13692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56593.exe
        6⤵
        
        PID:1384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33927.exe
        5⤵
        
        PID:7936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46497.exe
        6⤵
        
        PID:11008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54849.exe
        6⤵
        
        PID:9640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45982.exe
        6⤵
        
        PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2075.exe
        5⤵
        
        PID:12324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21295.exe
        5⤵
        
        PID:16840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52005.exe
        5⤵
        
        PID:5448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45299.exe
      4⤵
      PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24437.exe
        5⤵
        
        PID:6752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61297.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34423.exe
        6⤵
        
        PID:14988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51932.exe
        6⤵
        
        PID:11032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37923.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61673.exe
        5⤵
        
        PID:16396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25395.exe
        5⤵
        
        PID:12948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-123.exe
      4⤵
      PID:7612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1463.exe
        5⤵
        
        PID:11776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10360.exe
        5⤵
        
        PID:17052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5803.exe
        5⤵
        
        PID:2468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18252.exe
      4⤵
      PID:12164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1665.exe
      4⤵
      PID:17000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63371.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63371.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42449.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62760.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15479.exe
        6⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7716.exe
        8⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54691.exe
        9⤵
        
        PID:9408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40201.exe
        9⤵
        
        PID:13572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42560.exe
        9⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31893.exe
        8⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65343.exe
        8⤵
        
        PID:16764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54540.exe
        7⤵
        
        PID:8504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15880.exe
        8⤵
        
        PID:9584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57257.exe
        8⤵
        
        PID:15464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34967.exe
        8⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50865.exe
        7⤵
        
        PID:11736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52005.exe
        7⤵
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15588.exe
        6⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40088.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32984.exe
        8⤵
        
        PID:10500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57449.exe
        8⤵
        
        PID:16240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47604.exe
        8⤵
        
        PID:10188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63581.exe
        7⤵
        
        PID:14152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52005.exe
        7⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39797.exe
        6⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47649.exe
        7⤵
        
        PID:12040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49255.exe
        7⤵
        
        PID:17108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5803.exe
        7⤵
        
        PID:17220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42995.exe
        6⤵
        
        PID:12988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6439.exe
        6⤵
        
        PID:8764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60082.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7166.exe
        6⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37758.exe
        7⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19087.exe
        8⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2327.exe
        8⤵
        
        PID:12744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46668.exe
        7⤵
        
        PID:10296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5263.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19836.exe
        7⤵
        
        PID:1880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20610.exe
        6⤵
        
        PID:9196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31816.exe
        6⤵
        
        PID:13308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10989.exe
        6⤵
        
        PID:16868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31269.exe
        5⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6107.exe
        6⤵
        
        PID:8568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58923.exe
        7⤵
        
        PID:17396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38772.exe
        7⤵
        
        PID:14224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14876.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11171.exe
        6⤵
        
        PID:1504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8603.exe
        5⤵
        
        PID:8492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26627.exe
        6⤵
        
        PID:14268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58082.exe
        6⤵
        
        PID:17148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32279.exe
        6⤵
        
        PID:11712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12076.exe
        5⤵
        
        PID:11136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10523.exe
        5⤵
        
        PID:1316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20035.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13149.exe
        5⤵
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50721.exe
        6⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9828.exe
        7⤵
        
        PID:7988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60840.exe
        7⤵
        
        PID:12772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15752.exe
        7⤵
        
        PID:2184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62874.exe
        6⤵
        
        PID:9720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28088.exe
        6⤵
        
        PID:13952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43844.exe
        6⤵
        
        PID:6828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32801.exe
        5⤵
        
        PID:6460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7223.exe
        6⤵
        
        PID:7424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64395.exe
        7⤵
        
        PID:10664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57065.exe
        7⤵
        
        PID:15680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50728.exe
        7⤵
        
        PID:216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29593.exe
        7⤵
        
        PID:14364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5557.exe
        6⤵
        
        PID:13412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21086.exe
        6⤵
        
        PID:3068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2738.exe
        5⤵
        
        PID:8516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20741.exe
        5⤵
        
        PID:10964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33547.exe
        5⤵
        
        PID:16916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43644.exe
        5⤵
        
        PID:2652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41337.exe
      4⤵
      PID:1112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52065.exe
        5⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25864.exe
        6⤵
        
        PID:9480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57524.exe
        6⤵
        
        PID:13652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58181.exe
        6⤵
        
        PID:12312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47078.exe
        5⤵
        
        PID:9312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21927.exe
        5⤵
        
        PID:15168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37621.exe
        5⤵
        
        PID:1684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52952.exe
      4⤵
      PID:7620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25475.exe
        5⤵
        
        PID:12656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5803.exe
        5⤵
        
        PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15008.exe
      4⤵
      PID:11144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65362.exe
      4⤵
      PID:16076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1395.exe
      4⤵
      PID:4552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46268.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46268.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13258.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18303.exe
        5⤵
        
        PID:3244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3658.exe
        6⤵
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14514.exe
        7⤵
        
        PID:228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40667.exe
        8⤵
        
        PID:15400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6100.exe
        8⤵
        
        PID:11888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45106.exe
        7⤵
        
        PID:10856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52601.exe
        7⤵
        
        PID:16640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31539.exe
        7⤵
        
        PID:12540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52786.exe
        6⤵
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57496.exe
        7⤵
        
        PID:14792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34880.exe
        7⤵
        
        PID:13712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20522.exe
        6⤵
        
        PID:11260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51315.exe
        6⤵
        
        PID:9868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4213.exe
        5⤵
        
        PID:6300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20929.exe
        6⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8352.exe
        7⤵
        
        PID:16408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18710.exe
        7⤵
        
        PID:16948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19344.exe
        6⤵
        
        PID:12628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29645.exe
        6⤵
        
        PID:16292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58847.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46420.exe
        5⤵
        
        PID:14680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54680.exe
        5⤵
        
        PID:4408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62412.exe
      4⤵
      PID:4200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7031.exe
        5⤵
        
        PID:6804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33752.exe
        6⤵
        
        PID:11548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60568.exe
        6⤵
        
        PID:10084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35105.exe
        5⤵
        
        PID:11964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12472.exe
        5⤵
        
        PID:16460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2053.exe
      4⤵
      PID:7796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52117.exe
        5⤵
        
        PID:12608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36722.exe
        5⤵
        
        PID:5384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26388.exe
      4⤵
      PID:12228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22665.exe
      4⤵
      PID:16952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6274.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6274.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47467.exe
      4⤵
      PID:1092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20353.exe
        5⤵
        
        PID:6628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46497.exe
        6⤵
        
        PID:10992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10578.exe
        6⤵
        
        PID:15968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56016.exe
        6⤵
        
        PID:11064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35105.exe
        5⤵
        
        PID:11952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12472.exe
        5⤵
        
        PID:16468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49516.exe
        5⤵
        
        PID:9876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20610.exe
      4⤵
      PID:8292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13420.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32596.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62842.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62842.exe
    3⤵
    PID:5264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56149.exe
      4⤵
      PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8458.exe
        5⤵
        
        PID:9468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57524.exe
        5⤵
        
        PID:13676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53085.exe
        5⤵
        
        PID:6736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61965.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55368.exe
      4⤵
      PID:15444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13501.exe
      4⤵
      PID:6884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39363.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39363.exe
    3⤵
    PID:7800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33669.exe
      4⤵
      PID:10636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57065.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58896.exe
      4⤵
      PID:1664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17443.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17443.exe
    3⤵
    PID:9080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6361.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6361.exe
    3⤵
    PID:16148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2684.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2684.exe
    3⤵
    PID:12924
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57098.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57098.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41167.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41167.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42859.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52324.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44561.exe
        6⤵
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17473.exe
        7⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40773.exe
        8⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57981.exe
        9⤵
        
        PID:9892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54543.exe
        9⤵
        
        PID:15324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7749.exe
        9⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29593.exe
        9⤵
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27700.exe
        8⤵
        
        PID:10828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2824.exe
        8⤵
        
        PID:15988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21782.exe
        8⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20927.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3205.exe
        7⤵
        
        PID:8448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
        7⤵
        
        PID:12356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52005.exe
        7⤵
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34363.exe
        6⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55739.exe
        7⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31313.exe
        8⤵
        
        PID:12028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49255.exe
        8⤵
        
        PID:17036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48782.exe
        8⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39267.exe
        7⤵
        
        PID:11584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54150.exe
        7⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42593.exe
        6⤵
        
        PID:8272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14903.exe
        6⤵
        
        PID:12780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55399.exe
        6⤵
        
        PID:9632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7704.exe
        5⤵
        
        PID:324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31623.exe
        6⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23150.exe
        7⤵
        
        PID:8256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21232.exe
        8⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49085.exe
        7⤵
        
        PID:13056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4850.exe
        6⤵
        
        PID:9756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55142.exe
        6⤵
        
        PID:13988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46742.exe
        6⤵
        
        PID:8344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53964.exe
        5⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5744.exe
        6⤵
        
        PID:9200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21945.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29842.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8272.exe
        5⤵
        
        PID:9680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8753.exe
        5⤵
        
        PID:13944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62314.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4606.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17919.exe
        5⤵
        
        PID:3656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52475.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20353.exe
        7⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51274.exe
        8⤵
        
        PID:14940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        8⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46668.exe
        7⤵
        
        PID:10304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5263.exe
        7⤵
        
        PID:15664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58181.exe
        7⤵
        
        PID:10088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46066.exe
        6⤵
        
        PID:9924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
        6⤵
        
        PID:12584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3637.exe
        5⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40555.exe
        6⤵
        
        PID:8428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54720.exe
        7⤵
        
        PID:5564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64924.exe
        6⤵
        
        PID:12824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28005.exe
        6⤵
        
        PID:2456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44696.exe
        5⤵
        
        PID:10068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40398.exe
        5⤵
        
        PID:14740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64065.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21737.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
        5⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38334.exe
        6⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40667.exe
        7⤵
        
        PID:15384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18160.exe
        7⤵
        
        PID:11228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39267.exe
        6⤵
        
        PID:11592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36950.exe
        6⤵
        
        PID:14924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55500.exe
        5⤵
        
        PID:9212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35681.exe
        5⤵
        
        PID:12720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3003.exe
        5⤵
        
        PID:812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60265.exe
      4⤵
      PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40088.exe
        5⤵
        
        PID:7180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18376.exe
        6⤵
        
        PID:12572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54408.exe
        6⤵
        
        PID:16824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-541.exe
        6⤵
        
        PID:6776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36882.exe
        5⤵
        
        PID:14788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9013.exe
        5⤵
        
        PID:11420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18340.exe
      4⤵
      PID:8552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21994.exe
      4⤵
      PID:13024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52434.exe
      4⤵
      PID:16672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-435.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-435.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46533.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27649.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14410.exe
        6⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64296.exe
        7⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12350.exe
        8⤵
        
        PID:9020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61416.exe
        8⤵
        
        PID:13232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54647.exe
        8⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60621.exe
        7⤵
        
        PID:9996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-103.exe
        7⤵
        
        PID:13620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33729.exe
        7⤵
        
        PID:1876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46616.exe
        6⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29891.exe
        7⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15797.exe
        8⤵
        
        PID:9016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60110.exe
        8⤵
        
        PID:15588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37953.exe
        8⤵
        
        PID:11700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62620.exe
        7⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61673.exe
        7⤵
        
        PID:12316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35509.exe
        7⤵
        
        PID:11892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24912.exe
        6⤵
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20597.exe
        7⤵
        
        PID:14044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18055.exe
        7⤵
        
        PID:4464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26388.exe
        6⤵
        
        PID:12280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22665.exe
        6⤵
        
        PID:16908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15977.exe
        6⤵
        
        PID:7316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59013.exe
        5⤵
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54229.exe
        6⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40088.exe
        7⤵
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2942.exe
        8⤵
        
        PID:10692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57065.exe
        8⤵
        
        PID:15696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15175.exe
        8⤵
        
        PID:10868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62511.exe
        7⤵
        
        PID:10908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24313.exe
        7⤵
        
        PID:14448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16956.exe
        7⤵
        
        PID:11640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2136.exe
        6⤵
        
        PID:8868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35397.exe
        7⤵
        
        PID:11916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44698.exe
        7⤵
        
        PID:748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33186.exe
        6⤵
        
        PID:13188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1242.exe
        6⤵
        
        PID:16076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44591.exe
        5⤵
        
        PID:6200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56232.exe
        6⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36191.exe
        7⤵
        
        PID:11236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55503.exe
        7⤵
        
        PID:16204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51932.exe
        7⤵
        
        PID:10488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45983.exe
        6⤵
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19160.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53085.exe
        6⤵
        
        PID:6416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7918.exe
        5⤵
        
        PID:7732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-236.exe
        6⤵
        
        PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10507.exe
        5⤵
        
        PID:12680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63242.exe
        5⤵
        
        PID:17348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46678.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29678.exe
        5⤵
        
        PID:4932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63144.exe
        5⤵
        
        PID:6056
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6056 -s 488
        6⤵
        Program crash
        
        PID:7132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3973.exe
        5⤵
        
        PID:9648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33954.exe
        5⤵
        
        PID:13960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24672.exe
        5⤵
        
        PID:9592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33168.exe
      4⤵
      PID:392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63357.exe
        5⤵
        
        PID:6680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59605.exe
        6⤵
        
        PID:9536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26770.exe
        7⤵
        
        PID:14880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54917.exe
        7⤵
        
        PID:11372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13476.exe
        6⤵
        
        PID:13696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62815.exe
        6⤵
        
        PID:1484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28219.exe
        5⤵
        
        PID:10132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22385.exe
        6⤵
        
        PID:14688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45961.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55083.exe
        5⤵
        
        PID:10800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6875.exe
      4⤵
      PID:7148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42008.exe
        5⤵
        
        PID:7160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8352.exe
        6⤵
        
        PID:16416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57605.exe
        6⤵
        
        PID:17064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31566.exe
        5⤵
        
        PID:12428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17008.exe
        5⤵
        
        PID:10004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8620.exe
      4⤵
      PID:10028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8644.exe
      4⤵
      PID:13776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5479.exe
      4⤵
      PID:4204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22997.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22997.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33679.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12080.exe
        5⤵
        
        PID:876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24079.exe
        6⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44639.exe
        7⤵
        
        PID:7968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49085.exe
        7⤵
        
        PID:13072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37953.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38831.exe
        6⤵
        
        PID:9880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49063.exe
        6⤵
        
        PID:14748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8924.exe
        6⤵
        
        PID:8600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55857.exe
        5⤵
        
        PID:7036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5661.exe
        6⤵
        
        PID:7976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46860.exe
        6⤵
        
        PID:10752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5647.exe
        6⤵
        
        PID:16248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54647.exe
        6⤵
        
        PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58764.exe
        5⤵
        
        PID:9124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22794.exe
        6⤵
        
        PID:576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22766.exe
        5⤵
        
        PID:12448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4760.exe
        5⤵
        
        PID:16792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38152.exe
        5⤵
        
        PID:3672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9127.exe
      4⤵
      PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5723.exe
        5⤵
        
        PID:7704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58921.exe
        5⤵
        
        PID:13816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52005.exe
        5⤵
        
        PID:5372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32779.exe
      4⤵
      PID:7668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26388.exe
      4⤵
      PID:12264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22665.exe
      4⤵
      PID:16944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
      4⤵
      PID:10396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23108.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23108.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31131.exe
      4⤵
      PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6709.exe
        5⤵
        
        PID:7648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15854.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22612.exe
        6⤵
        
        PID:16864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5803.exe
        6⤵
        
        PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25976.exe
        5⤵
        
        PID:11180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25026.exe
        5⤵
        
        PID:16068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33921.exe
        5⤵
        
        PID:5292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27897.exe
      4⤵
      PID:7808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33176.exe
        5⤵
        
        PID:11204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5425.exe
        5⤵
        
        PID:14800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25673.exe
        5⤵
        
        PID:12512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41244.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41362.exe
      4⤵
      PID:16156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25260.exe
      4⤵
      PID:8588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5672.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5672.exe
    3⤵
    PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21998.exe
      4⤵
      PID:8152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23454.exe
        5⤵
        
        PID:13604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39267.exe
      4⤵
      PID:11600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33729.exe
      4⤵
      PID:1784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49899.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49899.exe
    3⤵
    PID:9184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37753.exe
      4⤵
      PID:10608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57065.exe
      4⤵
      PID:15704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58896.exe
      4⤵
      PID:3456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61231.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61231.exe
    3⤵
    PID:11160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57673.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57673.exe
    3⤵
    PID:15816
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12478.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12478.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12132.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12132.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5500.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13258.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18303.exe
        6⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32007.exe
        7⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12350.exe
        8⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13585.exe
        8⤵
        
        PID:13200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50563.exe
        8⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40996.exe
        7⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15208.exe
        7⤵
        
        PID:15160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36885.exe
        6⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20929.exe
        7⤵
        
        PID:8308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6787.exe
        7⤵
        
        PID:12196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3003.exe
        7⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51830.exe
        6⤵
        
        PID:7872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41546.exe
        6⤵
        
        PID:12764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2804.exe
        6⤵
        
        PID:4048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58328.exe
        5⤵
        
        PID:4772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38744.exe
        6⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12350.exe
        7⤵
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58539.exe
        8⤵
        
        PID:16868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40806.exe
        8⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61416.exe
        7⤵
        
        PID:13224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42395.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46886.exe
        6⤵
        
        PID:9988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59561.exe
        6⤵
        
        PID:15332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5525.exe
        6⤵
        
        PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49225.exe
        5⤵
        
        PID:7380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62641.exe
        6⤵
        
        PID:10540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57449.exe
        6⤵
        
        PID:16264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56400.exe
        6⤵
        
        PID:10228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16574.exe
        5⤵
        
        PID:10916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21513.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49316.exe
        5⤵
        
        PID:11316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60876.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6434.exe
        5⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37758.exe
        6⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46606.exe
        7⤵
        
        PID:7996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2327.exe
        7⤵
        
        PID:14060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28060.exe
        7⤵
        
        PID:10012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24606.exe
        6⤵
        
        PID:10936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31331.exe
        6⤵
        
        PID:17012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22873.exe
        6⤵
        
        PID:9500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19044.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-586.exe
        6⤵
        
        PID:11940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5803.exe
        6⤵
        
        PID:4164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2843.exe
        5⤵
        
        PID:12884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17194.exe
        5⤵
        
        PID:5484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16640.exe
      4⤵
      PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29891.exe
        5⤵
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45454.exe
        6⤵
        
        PID:9524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16574.exe
        6⤵
        
        PID:14484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36530.exe
        6⤵
        
        PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50865.exe
        5⤵
        
        PID:11724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36593.exe
        5⤵
        
        PID:14416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51270.exe
        5⤵
        
        PID:13468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30778.exe
      4⤵
      PID:7516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29292.exe
        5⤵
        
        PID:15116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59001.exe
        5⤵
        
        PID:11396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10507.exe
      4⤵
      PID:12644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63242.exe
      4⤵
      PID:16940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47539.exe
      4⤵
      PID:5444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51172.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51172.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1006.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1966.exe
        5⤵
        
        PID:3564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40607.exe
        6⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4893.exe
        7⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3518.exe
        8⤵
        
        PID:10940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2907.exe
        8⤵
        
        PID:17068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23231.exe
        8⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27700.exe
        7⤵
        
        PID:10820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2824.exe
        7⤵
        
        PID:15936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33926.exe
        7⤵
        
        PID:8240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35380.exe
        6⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15854.exe
        7⤵
        
        PID:10496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36530.exe
        7⤵
        
        PID:1236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60867.exe
        6⤵
        
        PID:14100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51813.exe
        6⤵
        
        PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17534.exe
        5⤵
        
        PID:6268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8458.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57524.exe
        6⤵
        
        PID:13644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41845.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11072.exe
        5⤵
        
        PID:9708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33954.exe
        5⤵
        
        PID:13932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56089.exe
        5⤵
        
        PID:3404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62412.exe
      4⤵
      PID:2764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4893.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51157.exe
        6⤵
        
        PID:10968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24113.exe
        6⤵
        
        PID:7916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5557.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62712.exe
        5⤵
        
        PID:16948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24812.exe
        5⤵
        
        PID:10624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54077.exe
      4⤵
      PID:8408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4094.exe
        5⤵
        
        PID:10592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42395.exe
        5⤵
        
        PID:15952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34063.exe
      4⤵
      PID:12068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17386.exe
      4⤵
      PID:16496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23464.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23464.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18303.exe
      4⤵
      PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32007.exe
        5⤵
        
        PID:6948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8458.exe
        6⤵
        
        PID:9488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6874.exe
        6⤵
        
        PID:14280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39515.exe
        6⤵
        
        PID:12752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56729.exe
        5⤵
        
        PID:8004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18769.exe
        5⤵
        
        PID:14420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14321.exe
        5⤵
        
        PID:10672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40969.exe
      4⤵
      PID:6496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26165.exe
        5⤵
        
        PID:8140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11367.exe
        6⤵
        
        PID:16684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22794.exe
        6⤵
        
        PID:1680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64924.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28005.exe
        5⤵
        
        PID:1056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21186.exe
      4⤵
      PID:9820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
      4⤵
      PID:14192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3480.exe
      4⤵
      PID:17232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22674.exe
      4⤵
      PID:12868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30866.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30866.exe
    3⤵
    PID:840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-508.exe
      4⤵
      PID:8036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20431.exe
        5⤵
        
        PID:11744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31731.exe
        5⤵
        
        PID:14172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21482.exe
      4⤵
      PID:12420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33729.exe
      4⤵
      PID:5396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52237.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52237.exe
    3⤵
    PID:8872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60786.exe
      4⤵
      PID:15392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52343.exe
      4⤵
      PID:736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6231.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6231.exe
    3⤵
    PID:12464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21825.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21825.exe
    3⤵
    PID:16844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33149.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33149.exe
    3⤵
    PID:5720
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46678.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46678.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5500.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5500.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15204.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6434.exe
        5⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37758.exe
        6⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50607.exe
        7⤵
        
        PID:9328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16574.exe
        7⤵
        
        PID:14476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5803.exe
        7⤵
        
        PID:3264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62620.exe
        6⤵
        
        PID:9784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50873.exe
        6⤵
        
        PID:15372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20610.exe
        5⤵
        
        PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13420.exe
        5⤵
        
        PID:13300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2905.exe
      4⤵
      PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37758.exe
        5⤵
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7026.exe
        6⤵
        
        PID:10712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57065.exe
        6⤵
        
        PID:15688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18875.exe
        6⤵
        
        PID:12048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24606.exe
        5⤵
        
        PID:10900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9841.exe
        5⤵
        
        PID:17092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32980.exe
        5⤵
        
        PID:12348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6674.exe
      4⤵
      PID:9904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58338.exe
      4⤵
      PID:12844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6055.exe
      4⤵
      PID:6104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7591.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7591.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28993.exe
      4⤵
      PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9086.exe
        5⤵
        
        PID:5700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50607.exe
        6⤵
        
        PID:9368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60110.exe
        6⤵
        
        PID:15320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64403.exe
        6⤵
        
        PID:11876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9527.exe
        5⤵
        
        PID:9560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16062.exe
        5⤵
        
        PID:15252
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15252 -s 464
        6⤵
        Program crash
        
        PID:16980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55910.exe
      4⤵
      PID:7560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41043.exe
        5⤵
        
        PID:12104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11730.exe
        5⤵
        
        PID:17020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20656.exe
        5⤵
        
        PID:10864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52619.exe
      4⤵
      PID:11128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25026.exe
      4⤵
      PID:15912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16640.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16640.exe
    3⤵
    PID:5272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39128.exe
      4⤵
      PID:6920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7026.exe
        5⤵
        
        PID:10728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54927.exe
        5⤵
        
        PID:15800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28060.exe
        5⤵
        
        PID:6056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-897.exe
      4⤵
      PID:12864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62712.exe
      4⤵
      PID:17024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27884.exe
      4⤵
      PID:6400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40015.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40015.exe
    3⤵
    PID:7440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41928.exe
      4⤵
      PID:14164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53957.exe
      4⤵
      PID:11308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10507.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10507.exe
    3⤵
    PID:12728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47539.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47539.exe
    3⤵
    PID:10232
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62107.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62107.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:8
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15204.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15204.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8572.exe
      4⤵
      PID:3580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2651.exe
      4⤵
      PID:6600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26165.exe
        5⤵
        
        PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64924.exe
        5⤵
        
        PID:12800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11668.exe
        5⤵
        
        PID:5340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34507.exe
      4⤵
      PID:9792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44836.exe
      4⤵
      PID:14136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3480.exe
      4⤵
      PID:14052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8725.exe
      4⤵
      PID:10016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60274.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60274.exe
    3⤵
    PID:5192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64701.exe
      4⤵
      PID:6528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38931.exe
        5⤵
        
        PID:9764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15505.exe
        5⤵
        
        PID:14540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5803.exe
        5⤵
        
        PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54374.exe
      4⤵
      PID:13280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62712.exe
      4⤵
      PID:16936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19716.exe
      4⤵
      PID:6108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59723.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59723.exe
    3⤵
    PID:7784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26388.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26388.exe
    3⤵
    PID:12148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22665.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22665.exe
    3⤵
    PID:16892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1937.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1937.exe
    3⤵
    PID:16908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23403.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23403.exe
    3⤵
    PID:12700
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1991.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1991.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15672.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15672.exe
    3⤵
    PID:4600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7031.exe
      4⤵
      PID:2160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35485.exe
        5⤵
        
        PID:9844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15998.exe
        5⤵
        
        PID:14184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6280.exe
        5⤵
        
        PID:17204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46313.exe
        5⤵
        
        PID:13440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4099.exe
      4⤵
      PID:9068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12904.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26443.exe
      4⤵
      PID:6044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53855.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53855.exe
    3⤵
    PID:7744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16572.exe
      4⤵
      PID:8972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60867.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60867.exe
    3⤵
    PID:13940
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14370.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14370.exe
  2⤵
  PID:5248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36689.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36689.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33285.exe
      4⤵
      PID:8092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2327.exe
      4⤵
      PID:14980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23727.exe
      4⤵
      PID:14360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36361.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36361.exe
    3⤵
    PID:10568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5263.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5263.exe
    3⤵
    PID:15656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20656.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20656.exe
    3⤵
    PID:12116
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61195.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61195.exe
  2⤵
  PID:7680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36741.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36741.exe
    3⤵
    PID:13092
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56923.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56923.exe
  2⤵
  PID:12172
- C:\Users\Admin\AppData\Local\Temp\Unicorn-530.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-530.exe
  2⤵
  PID:16976
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8278.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8278.exe
  2⤵
  PID:12964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 6056 -ip 6056
1⤵
PID:7076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 13012 -ip 13012
1⤵
PID:13428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 13012 -ip 13012
1⤵
PID:14896

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Modifies data under HKEY_USERS
PID:16844

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10252.exe

Filesize
468KB

MD5
4402b83566b2733aac54f8b25179d36c

SHA1
2bdba2a755ed4f5ce7a70d2be004c457a3463276

SHA256
c8c10c1a2cb610b381ee49a3f18d319785e22fa32fe11c10d07be5ed41b99493

SHA512
693426a067c69c2d411b3c5176461051ec9807dac7393eaf0cf84873f860e0ef9fc6efbb0240f9ba10231b9db885db1fe3b21b83a12447968e1d7c233623d5d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11722.exe

Filesize
468KB

MD5
cbd23178c8880b3c4c787816f762668e

SHA1
74498f2b687e3bc34984bbd7e1b767c2160b07c0

SHA256
d00c161381344a31a4e0dc624cf56f5a235bd3cc06a3c322e1ecf3257359e604

SHA512
60fb7832e4031af137c7a7f7f1408690361fd897a0e5e82c1fda790d169abcce869f07c68fbd408a2150ebc6da5ffee46f4ec0f1df42f0c7f66c405ca091af87

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11861.exe

Filesize
468KB

MD5
acef86bb156354e494dbb5fc4b641a99

SHA1
7493641fe362aaf1ba0141eb74c0c428c0f0f2ee

SHA256
514260b2c88ec6d29146781ea12d13113395e7dc9c8ee77ed2442ab3f86a4f85

SHA512
6595abb8d9cb0e80e543dc7760b7aebe417a1ab3a184bc3aac2f01f64391bc3de348d2fa0d6fb655cb514c403c1ccc12ff1e01c9658c0daa2570530d7c14d458

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12132.exe

Filesize
468KB

MD5
78608ebb0b089b08dc4de16b6a89484f

SHA1
4001933a94262a0ee81d455b8c7f2d4a673f9e65

SHA256
ef40bfc789cfb529e4df3fc0975958449997b68dcb2e432db7641ed3e9944097

SHA512
033d9642107985a2b764afc41410f397cdb02b59fb1652278844b6df565874f07af0d892d335f540b15bc5561a56a653f812149bef11dd0ab4dc6a9576789081

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12478.exe

Filesize
468KB

MD5
2cf7ba1c8f78a66a7ad767ec38bbc879

SHA1
ade38684acae2ab3d95ba0ef6e3fe2d1989ad129

SHA256
64aa464bd31630a120600543dafc15e62ab89be7e5c07282bf90cb02a7197aae

SHA512
f4fa01f0a58ec68e258b25e1474f68e7ab0b703cd8d863f436558249fa6120a63e009cd85bb490e9ca0f8a885c6d440ad484f5c4972f3a7f8b34f5af65641e6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13367.exe

Filesize
468KB

MD5
b1ada9cea30b6ea28de95a5976f38fed

SHA1
2c1320e4fb4d738cfef40be864e34c65538d044d

SHA256
59a6754b8a3ba2a1fd5e030f69f4c6c7cdc59e14193943c46c115184b73ecbf5

SHA512
28d87a2af880017663ab3cbe757f3de26a7aa53f3680d6d26abdb19c00d06cbd5737c50652f29c0edb12660c85489a3a67795699b2c7c741a8d6b9473e0103a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16383.exe

Filesize
468KB

MD5
f684d8f0fc7393d0daee1527495f66a9

SHA1
c564f5b3d792ad546b71892ab90d8cb47e1bf4c7

SHA256
1743c79a5a288ad3090617ee58cd96af964cd12b88f9a2e48aac71bd5836c5fb

SHA512
cb0641a8702ed9c70522009b5d2483ac2ea04c2227372ab200a3926a2261eb14061d0b3f33df9d326d423af1fdbc3082b0d503aa2e3776c8cf8bab026d9b5650

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22997.exe

Filesize
468KB

MD5
5ca97b369218590d6e0d12cf5c56ce37

SHA1
a9e632b552304e4a8b87c6f01d3070a0eb5ac8b7

SHA256
0b7f2f1a70490cd5fb96dae8feba766d6b23d08a5e8f80110c0c2d856f9cf16d

SHA512
929b73897a06d56bae06bfe72518a7fe92129a811d130612247c625d580f63b49711921f9f85bb323f8a19a821a02ea6ba65adc640388c2d8749d681bcd883d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26523.exe

Filesize
468KB

MD5
26896c179ba7de840e1eca86eb75bb50

SHA1
7cf2c79d4732e43798ce9cdaf2db8bc2a70191d2

SHA256
1b21a63044a68f00417e38aab3f3695a86e9ac623f6c9c3f61d619afab83752b

SHA512
25dac73ed9b9bc73a6cad4855037ebd47e06e486bd85565cf63ca07246693ca355ca6c769e17fd451c51159db88410a8f7a726ec3975b2a544fc8c328340b5b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34622.exe

Filesize
468KB

MD5
d40aea45060f26166077e599b5fb9612

SHA1
d008182b934cb3f58bc7d5abeed71975feca9fe9

SHA256
44ca18129c3051bb64297f810e483bf02d03c045baf5eab9d8c5f87b9cc9b433

SHA512
389d6fea0187402ac8a9879cfa948a40502143102100e02aad03e956cb364bb840501cdf8ff5b38c9bfa3ed83067ca71e148431d5520b9fe6e88b50a417186b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41167.exe

Filesize
468KB

MD5
0c87c4919a68964ed7159f332731318d

SHA1
67d3729ad9d1c7bd973b0e3b084b24ab127c57a3

SHA256
8914594ae986c19e2e3a7b0e7ddc8661ea64f960b3d5a3b97ab7d381a4535d28

SHA512
6948d4502faf418171d263f184df3a695ce4c1a7337ee15cea0577dcb9ec06b4ee20d460dceec5d401257bdb74608102024affed6ff7c290a1084b236bd6b5f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42449.exe

Filesize
468KB

MD5
fa8a3c981585ccbe030f6efc99b784a9

SHA1
51e7d001b82512b04cdf9aef595de3b26737fce2

SHA256
a10db56cd26a6bc80511691e8c7365d2cdd7f5d259d5c323ac310d78367284a9

SHA512
a69b692b51ef0740c0be09b9f0939cc39bc35349ccc24d4f0bab9b3135940b04df911fcc50ffcc4f70959406b31ff5e0a04321aa9705733425d69bd850b81125

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42859.exe

Filesize
468KB

MD5
6e4874e02f6d8e39e44eaf6bac7aaad5

SHA1
91d4a13c842122489c7ee1561f68ab4c4f62c789

SHA256
b773bb59ac073e22898aa85a5b1c3dd0981f814fd0c3e1c2985eed5999594760

SHA512
0099064566013677adf2e4f8b95325160598b5171c30f31f2d6544b611948c77b89f14e1809416873111c4199947df0f4d0657b79415ae9663aa07eed1a7e907

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-435.exe

Filesize
468KB

MD5
45a7159df4b68cd682fee82a31e14f74

SHA1
bd89be2d43d65ea37a4b6b04115b5aeec30a8d8e

SHA256
f62359c67bde24d8bdcf7a4588b70c4e118875a69b2f6f59dcdf25d1fb310de1

SHA512
19c059b597d6b5fb9d4be13efdf93d95be7c4e350c6e4fbc1881e3d4f0e8b96b334a551329884d1a33a295773a820a2c7298220bc05d1819bf1a5320a9a3ba46

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45718.exe

Filesize
468KB

MD5
1b7a94a658f7e6a5d350feeaff365dbf

SHA1
7a3d5206938544d98d50340c9f31644f1078f397

SHA256
daa27748a3468c1337e655b0e23166bcc4fc39560817b61c35b2395f93ed080b

SHA512
3398e74bd8ed603214e892dd3e18065051d9d8bc89ba944b5139c90f67b579fb16347f6593d66893311cfadf06e9019bf765df4e597255efef78f7e0fd254a75

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46268.exe

Filesize
468KB

MD5
05118321694fe814296c6124557fe6ae

SHA1
dffaf8f62e834d66263d7bf3b01ccbea84917061

SHA256
f9ae0f58e717e981257ecdb309df1bd98a6f8af16faa3d116f838b881c809c27

SHA512
8e079a3ec2c7aa88d9b250ef2b8bdb754732b2bbe089881309ab77eb822a0584e46f3869a39db2c62590a5338068af7ab1d1739685287fae01fa3c97d510b94c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46533.exe

Filesize
468KB

MD5
01e4eba11eb1731d322c92ce3d4fa476

SHA1
e9e7a322252c926838d314fb247a3b30f1e3c342

SHA256
2086d3947fb53616bdd7523387124ca57e0dacf62b7b0f43dcedef536e35d4a9

SHA512
b62f1e167800884818cd73aff819a8293f9b1d030a0f4c906d1fe081bdbb10c314beae161a2102f380935f0f7b004c2cb96615fc3bedf100f281f3279126bc73

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46678.exe

Filesize
468KB

MD5
1b4bd5508f311b00b5b34183b1a64e71

SHA1
87821da6f6b3d921df743a6498ca83761e91ea26

SHA256
c0fef3e6679d3695e2801fcedd5d7109b71a1e8eef9b0bc61b0a5b572e233916

SHA512
a8fd396570f65d10796cb330d2a70928985afa3afda6ed505e5b36865521cb917e8990a9d3994b9b3dbcf86914ae7d0c82ee0da301e7581ba9d0f021e1cfb2a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51172.exe

Filesize
468KB

MD5
7e0cedbd852726907ac9e4938c19a1d8

SHA1
46a4e227fd019f3c1cd90380309add6976986bcf

SHA256
6d627401d1f451fd1819722ba1953719492925e149a0b95371a578ecc061588d

SHA512
8df70e3b404448d2eb608c78457a4fd7b9b8918a06fa6cb7065b8126eeef5dd16dbd78ff1ab553f1d4a21f92b7a472649470d80b52603f7d60bb6c1c76de5508

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52324.exe

Filesize
468KB

MD5
467e7208430722821de9f41d4f6fbe08

SHA1
0673d6f01c94e237a8742ffaa01be2365572e430

SHA256
6ecd8185741ddf7dd6fb0e0ad399f13c553478808f08a1ea75a415e1b38d8241

SHA512
839564acc0cc5a770307f5ea090422b33705cf15f922e45df6248131f796a8c47fbc0bc1d9f04d537d104a9651c16a197e62dd3254fe7b14058cead75d0ebf92

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54488.exe

Filesize
468KB

MD5
b8812447dc188332efe03ddaae3d3921

SHA1
dc6d458aa59d4840c5e8a6c2bf3e8ec107fa4a46

SHA256
6b93c50b0e9198cf8a0168c165459c3c5309f428a7ee0f1babd774b458324df1

SHA512
d0e28af8d8e8544e937843dce3120a75b909ef7201d3378dde36b1311f3e5b3e21172b531dbe4f8d0a51b7886a83ad843d38f2807999f10903e89fa994cedabe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5500.exe

Filesize
468KB

MD5
2a23f6c9c42f2412eec80e688edaa262

SHA1
d5c3b5edff2c7b858b4274cae12b496937b1664a

SHA256
8a8dcc774d57eae68a6ea37c5f712e4b512eca92f1383e20d7f825899832748a

SHA512
da0feb85bcfe53f5088456074880024194acc538d9f1bb325711f515ee274f585624e3264bf9c4f4a803ff8e44bed78b1ca9458d8e8f8661a1459e1e10cedc81

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55391.exe

Filesize
468KB

MD5
86f811ff20317f2541600e98df9bba6f

SHA1
fefe17c9174ee74e2e08d7934b86d1d9c1e61b1e

SHA256
703843656291c1e53f81fc7ee65bddf49b05e86f4ccb813f2d27537eaffa8445

SHA512
989fb8f963b8f698cada3757232a997c344cdc09fb20c187e9c02d9f5da15fee12a35c461d150aa67e37af875254a65801768e555f18c742607c68343d846268

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57098.exe

Filesize
468KB

MD5
b6a88833d5aa06a8b74b222e71482ba5

SHA1
4b5c7d5210d671436fbd510f3a0f678a0cd6a6c1

SHA256
674bb3141fe936afc73232de4c57d05202038ef7dcebdb473199ea98c6edbdaa

SHA512
0dcec2abf81920ca6ea9ef47ca98633b664bbad034a9400b7ea38efc773c190dd7f12c8a7a1f875f86d1cb65c6592c34b2dadb53fab789067d4b098e653f1abd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57804.exe

Filesize
468KB

MD5
d246e369e740d98f846ab0ed93d32945

SHA1
096fc11f2a719749a51532c784d8d1fa91c94935

SHA256
94a53f72f8f1aa2ccc3b06b24b7830f7d48193e8ae1c9f10b32db1d849d733ce

SHA512
ef3d3c08a423c4d905ae322029759f082e7edb34cf75ebb69b5a09c30823e0ed16cd23bbb42cd6ea158cd5a2d89652f2507b8faa19acb743fff688ac83938527

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57887.exe

Filesize
468KB

MD5
438f16ad32ba6780d1380b5a875aa48c

SHA1
ca9815197a258e48b7f6e56c7c27cad00e969696

SHA256
ad56b5cc5a85161ca837d054d3e4fe15fe83ae7e4afa33e0b850bf4ccab10b6a

SHA512
ff1c178cfcc454daedd5a2dfbddc885bb80cd4e72596d3ccd2407293bd3eadff659c2dc60de8679b7a61340ab28db59d7a97febcad2742c9a71fe9d2c9b93dd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58328.exe

Filesize
468KB

MD5
353cd0359598fe79fadd93f8c737fd84

SHA1
9e1d6db9729224f69a1f42c0477bd4f9a7fad7bd

SHA256
7162ad26283edf9e2d5d6daae06be7aa6fad016b1e4be02ac5b34b97b74c8ee1

SHA512
1f853fc2bf0d53a4422c955a0700232c7f511c407f5c741c25100c88be8a076197b33a58c75970131347825d037312c5cec735f467e94caff1da0e077a7b407d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61416.exe

Filesize
468KB

MD5
71755ab95772a63248e4501b3ddf2435

SHA1
1dba7ac5b9c3b121702f59c253cbea337dec0c26

SHA256
ac1111e104e40e2761d6ac454f0627a0d8b7df2362c5d465227a584267e3ac76

SHA512
82bfd4a6174a8c0e56256e7ed27e206fa8a1272ac51ec5d2862d56b292b574ebfaf25694bb5437c91633014c0fa486eaa440f21a3ec7f63bd35935ccc56beff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62107.exe

Filesize
468KB

MD5
f168b68ba28f71af892775fbf1898a3c

SHA1
5090c5e1ca9cc658a7e00e2c8d1da67c6e541f6e

SHA256
f29c42c15c5020b0225720c58d399fa00733e9fbefdb656a60adc228f6d3b675

SHA512
c9612e18db1ab0492bafff41997118d52f36c2bc847d0025b26ca01625e8ddb177c79b06c827aafaf2a592efc86142437f63d2a1f1e69f3ca826e92d5eb373ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63371.exe

Filesize
468KB

MD5
a1b5f38e159fad11056bfc0c08c95e17

SHA1
1bf76787b34b93100124ab764a96cb779245835d

SHA256
0c63e9b1657eaf12503ebba2847db36b30a266847edd13ea9bde975363162d12

SHA512
b20952a7168be56991f5ca676e2d3c7631adc40156b11d39a5423100071becd57a3737853be326174992dda46b03e9fa4e6209377f54f64f662c4c87046368ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64907.exe

Filesize
468KB

MD5
007559b153845edf0b5c189499b8893a

SHA1
2dd9e7bec1c0b0c691a47a98720679904b8eb02e

SHA256
f2239ebc385c6f4c92155f111ac067d068a6b625a57cf312020a1cbce86970c6

SHA512
f4696d6e2e04f18b5114827a037707ee5f154598e7b2dab40faa56c7b95c62cdb2caf079e7a683368d4a7506b0a7ee985818a3cee1639dc8a16ca11e90bc4b92

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7342.exe

Filesize
468KB

MD5
b46a47a7122fde13bf0bfe5d73845eac

SHA1
4badaa3f7240ca8ad55da856c144a96577e70ab4

SHA256
85b93d565f1cca249e4a96965dd9903b01fb72b0a5e682cdd89f87a5693d4127

SHA512
7ab54f517e8186cd4a7b48b4a544f3704cb409cc80464bcfcd75adb30c60892493d69b00ac0e9f57205786966b133cb97682855d12a6d3a2356c34cc5aead3ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8048.exe

Filesize
468KB

MD5
e56912d54bf12fa9872e784318c7b6bc

SHA1
a163f86b438671bd5f9e887e29477bf01e62343f

SHA256
ea648c10cb0db46b3dbf07d8a0685f9ebc4154de22b25c4144984d262bf2a577

SHA512
a621a222cf1b11b8d60981aaf41ef2f9d478a56f2888d43f455134f1428ff9a563dda58d3d0fa83bff5b21ba66680a75d5012a1fdcaf29766103cc0987de6f5a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads