d508eaa581dec017516e41872b16df3c13fb7ceabf94e3d590a85512c3249b28

Analysis

max time kernel
117s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2024 01:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d508eaa581dec017516e41872b16df3c13fb7ceabf94e3d590a85512c3249b28N.exe
Size

468KB
MD5

49bd42b277180268f3f9fd095ae66430
SHA1

f508110d32f3179997109c6459e16588d9ec7c7e
SHA256

d508eaa581dec017516e41872b16df3c13fb7ceabf94e3d590a85512c3249b28
SHA512

7b224d455134cc1cf18390c0927451c3562ee81e5272d92d75279b140f78ac1672f0eb1c8dca5e22bd3fddb475b3f099f7d61c0415dbf4f90b703f85498d658f
SSDEEP

3072:96+Co36OIV3KtbYxPzcjNfT/rChZPIpvn1HCOVLTN0Fp62vNSilP:96ToQ9KtiP4jNf808SN0zRvNS

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1732	Unicorn-10687.exe
4092	Unicorn-59040.exe
1056	Unicorn-19273.exe
4640	Unicorn-35393.exe
2468	Unicorn-30624.exe
388	Unicorn-10950.exe
2892	Unicorn-57742.exe
3432	Unicorn-48800.exe
3120	Unicorn-31399.exe
4700	Unicorn-46688.exe
4844	Unicorn-46496.exe
4504	Unicorn-46496.exe
4444	Unicorn-45903.exe
4736	Unicorn-51768.exe
3948	Unicorn-32167.exe
4528	Unicorn-18848.exe
1512	Unicorn-65287.exe
4848	Unicorn-19009.exe
4300	Unicorn-41358.exe
892	Unicorn-53025.exe
3380	Unicorn-44992.exe
2868	Unicorn-30663.exe
3428	Unicorn-50529.exe
4740	Unicorn-3773.exe
3976	Unicorn-12703.exe
2348	Unicorn-13398.exe
500	Unicorn-30855.exe
1156	Unicorn-59143.exe
3204	Unicorn-45952.exe
2504	Unicorn-7341.exe
3508	Unicorn-60734.exe
2044	Unicorn-51331.exe
4516	Unicorn-52300.exe
5104	Unicorn-31465.exe
1968	Unicorn-64901.exe
2560	Unicorn-21342.exe
1972	Unicorn-45374.exe
1448	Unicorn-49354.exe
4304	Unicorn-43573.exe
4360	Unicorn-23972.exe
1636	Unicorn-6941.exe
4936	Unicorn-29635.exe
4464	Unicorn-54145.exe
4480	Unicorn-63075.exe
1660	Unicorn-15327.exe
1852	Unicorn-17828.exe
1836	Unicorn-18902.exe
1220	Unicorn-19168.exe
4280	Unicorn-34435.exe
4388	Unicorn-35404.exe
3112	Unicorn-22436.exe
1268	Unicorn-2146.exe
4440	Unicorn-2146.exe
3924	Unicorn-15337.exe
1052	Unicorn-16836.exe
3100	Unicorn-15145.exe
5048	Unicorn-28880.exe
4384	Unicorn-29072.exe
2940	Unicorn-65374.exe
1944	Unicorn-39177.exe
2216	Unicorn-28291.exe
548	Unicorn-24259.exe
4560	Unicorn-2909.exe
4936	Unicorn-16292.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
15340	11320	WerFault.exe
19200	14496	WerFault.exe	720
18088	17428	WerFault.exe	772
18064	18240	WerFault.exe
9668	18384	WerFault.exe	829

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28731.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42105.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11005.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5613.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11969.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54578.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41298.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3553.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3558.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33870.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64238.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24588.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32075.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28858.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61687.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16076.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39076.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31762.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19617.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10956.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60355.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38942.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28358.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9125.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41341.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31595.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46688.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13732.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54496.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61004.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55913.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22828.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61085.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27104.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12386.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19910.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59872.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26777.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41355.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37932.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31876.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7600.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62388.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36788.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40673.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13739.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48826.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18848.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58090.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53805.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48561.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17313.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17313.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12121.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18384.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60958.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17780	dwm.exe
Token: SeChangeNotifyPrivilege	17780	dwm.exe
Token: 33	17780	dwm.exe
Token: SeIncBasePriorityPrivilege	17780	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4352	d508eaa581dec017516e41872b16df3c13fb7ceabf94e3d590a85512c3249b28N.exe
1732	Unicorn-10687.exe
4092	Unicorn-59040.exe
1056	Unicorn-19273.exe
4640	Unicorn-35393.exe
388	Unicorn-10950.exe
2468	Unicorn-30624.exe
2892	Unicorn-57742.exe
3432	Unicorn-48800.exe
3120	Unicorn-31399.exe
4844	Unicorn-46496.exe
4736	Unicorn-51768.exe
4700	Unicorn-46688.exe
4504	Unicorn-46496.exe
3948	Unicorn-32167.exe
4444	Unicorn-45903.exe
4528	Unicorn-18848.exe
1512	Unicorn-65287.exe
4848	Unicorn-19009.exe
4300	Unicorn-41358.exe
892	Unicorn-53025.exe
500	Unicorn-30855.exe
2348	Unicorn-13398.exe
3976	Unicorn-12703.exe
3204	Unicorn-45952.exe
2504	Unicorn-7341.exe
1156	Unicorn-59143.exe
4740	Unicorn-3773.exe
3380	Unicorn-44992.exe
2868	Unicorn-30663.exe
3428	Unicorn-50529.exe
3508	Unicorn-60734.exe
2044	Unicorn-51331.exe
4516	Unicorn-52300.exe
5104	Unicorn-31465.exe
1968	Unicorn-64901.exe
2560	Unicorn-21342.exe
1972	Unicorn-45374.exe
1448	Unicorn-49354.exe
4360	Unicorn-23972.exe
4304	Unicorn-43573.exe
1636	Unicorn-6941.exe
4464	Unicorn-54145.exe
4480	Unicorn-63075.exe
1852	Unicorn-17828.exe
1660	Unicorn-15327.exe
1836	Unicorn-18902.exe
4280	Unicorn-34435.exe
4440	Unicorn-2146.exe
1220	Unicorn-19168.exe
1052	Unicorn-16836.exe
4388	Unicorn-35404.exe
3924	Unicorn-15337.exe
3100	Unicorn-15145.exe
4384	Unicorn-29072.exe
3112	Unicorn-22436.exe
5048	Unicorn-28880.exe
1268	Unicorn-2146.exe
2940	Unicorn-65374.exe
1944	Unicorn-39177.exe
2216	Unicorn-28291.exe
548	Unicorn-24259.exe
4560	Unicorn-2909.exe
4936	Unicorn-16292.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 1732	4352	d508eaa581dec017516e41872b16df3c13fb7ceabf94e3d590a85512c3249b28N.exe	89
PID 4352 wrote to memory of 1732	4352	d508eaa581dec017516e41872b16df3c13fb7ceabf94e3d590a85512c3249b28N.exe	89
PID 4352 wrote to memory of 1732	4352	d508eaa581dec017516e41872b16df3c13fb7ceabf94e3d590a85512c3249b28N.exe	89
PID 1732 wrote to memory of 4092	1732	Unicorn-10687.exe	91
PID 1732 wrote to memory of 4092	1732	Unicorn-10687.exe	91
PID 1732 wrote to memory of 4092	1732	Unicorn-10687.exe	91
PID 4352 wrote to memory of 1056	4352	d508eaa581dec017516e41872b16df3c13fb7ceabf94e3d590a85512c3249b28N.exe	92
PID 4352 wrote to memory of 1056	4352	d508eaa581dec017516e41872b16df3c13fb7ceabf94e3d590a85512c3249b28N.exe	92
PID 4352 wrote to memory of 1056	4352	d508eaa581dec017516e41872b16df3c13fb7ceabf94e3d590a85512c3249b28N.exe	92
PID 4092 wrote to memory of 4640	4092	Unicorn-59040.exe	97
PID 4092 wrote to memory of 4640	4092	Unicorn-59040.exe	97
PID 4092 wrote to memory of 4640	4092	Unicorn-59040.exe	97
PID 1056 wrote to memory of 2468	1056	Unicorn-19273.exe	99
PID 1056 wrote to memory of 2468	1056	Unicorn-19273.exe	99
PID 1056 wrote to memory of 2468	1056	Unicorn-19273.exe	99
PID 1732 wrote to memory of 388	1732	Unicorn-10687.exe	98
PID 1732 wrote to memory of 388	1732	Unicorn-10687.exe	98
PID 1732 wrote to memory of 388	1732	Unicorn-10687.exe	98
PID 4352 wrote to memory of 2892	4352	d508eaa581dec017516e41872b16df3c13fb7ceabf94e3d590a85512c3249b28N.exe	100
PID 4352 wrote to memory of 2892	4352	d508eaa581dec017516e41872b16df3c13fb7ceabf94e3d590a85512c3249b28N.exe	100
PID 4352 wrote to memory of 2892	4352	d508eaa581dec017516e41872b16df3c13fb7ceabf94e3d590a85512c3249b28N.exe	100
PID 4640 wrote to memory of 3432	4640	Unicorn-35393.exe	102
PID 4640 wrote to memory of 3432	4640	Unicorn-35393.exe	102
PID 4640 wrote to memory of 3432	4640	Unicorn-35393.exe	102
PID 4092 wrote to memory of 3120	4092	Unicorn-59040.exe	103
PID 4092 wrote to memory of 3120	4092	Unicorn-59040.exe	103
PID 4092 wrote to memory of 3120	4092	Unicorn-59040.exe	103
PID 388 wrote to memory of 4844	388	Unicorn-10950.exe	105
PID 388 wrote to memory of 4844	388	Unicorn-10950.exe	105
PID 388 wrote to memory of 4844	388	Unicorn-10950.exe	105
PID 2468 wrote to memory of 4700	2468	Unicorn-30624.exe	104
PID 2468 wrote to memory of 4700	2468	Unicorn-30624.exe	104
PID 2468 wrote to memory of 4700	2468	Unicorn-30624.exe	104
PID 2892 wrote to memory of 4504	2892	Unicorn-57742.exe	106
PID 2892 wrote to memory of 4504	2892	Unicorn-57742.exe	106
PID 2892 wrote to memory of 4504	2892	Unicorn-57742.exe	106
PID 1732 wrote to memory of 4444	1732	Unicorn-10687.exe	107
PID 1732 wrote to memory of 4444	1732	Unicorn-10687.exe	107
PID 1732 wrote to memory of 4444	1732	Unicorn-10687.exe	107
PID 4352 wrote to memory of 4736	4352	d508eaa581dec017516e41872b16df3c13fb7ceabf94e3d590a85512c3249b28N.exe	108
PID 4352 wrote to memory of 4736	4352	d508eaa581dec017516e41872b16df3c13fb7ceabf94e3d590a85512c3249b28N.exe	108
PID 4352 wrote to memory of 4736	4352	d508eaa581dec017516e41872b16df3c13fb7ceabf94e3d590a85512c3249b28N.exe	108
PID 1056 wrote to memory of 3948	1056	Unicorn-19273.exe	109
PID 1056 wrote to memory of 3948	1056	Unicorn-19273.exe	109
PID 1056 wrote to memory of 3948	1056	Unicorn-19273.exe	109
PID 3432 wrote to memory of 4528	3432	Unicorn-48800.exe	112
PID 3432 wrote to memory of 4528	3432	Unicorn-48800.exe	112
PID 3432 wrote to memory of 4528	3432	Unicorn-48800.exe	112
PID 4640 wrote to memory of 1512	4640	Unicorn-35393.exe	113
PID 4640 wrote to memory of 1512	4640	Unicorn-35393.exe	113
PID 4640 wrote to memory of 1512	4640	Unicorn-35393.exe	113
PID 3120 wrote to memory of 4848	3120	Unicorn-31399.exe	114
PID 3120 wrote to memory of 4848	3120	Unicorn-31399.exe	114
PID 3120 wrote to memory of 4848	3120	Unicorn-31399.exe	114
PID 4092 wrote to memory of 4300	4092	Unicorn-59040.exe	115
PID 4092 wrote to memory of 4300	4092	Unicorn-59040.exe	115
PID 4092 wrote to memory of 4300	4092	Unicorn-59040.exe	115
PID 4844 wrote to memory of 892	4844	Unicorn-46496.exe	116
PID 4844 wrote to memory of 892	4844	Unicorn-46496.exe	116
PID 4844 wrote to memory of 892	4844	Unicorn-46496.exe	116
PID 4736 wrote to memory of 3380	4736	Unicorn-51768.exe	118
PID 4736 wrote to memory of 3380	4736	Unicorn-51768.exe	118
PID 4736 wrote to memory of 3380	4736	Unicorn-51768.exe	118
PID 2468 wrote to memory of 2868	2468	Unicorn-30624.exe	121

C:\Users\Admin\AppData\Local\Temp\d508eaa581dec017516e41872b16df3c13fb7ceabf94e3d590a85512c3249b28N.exe
"C:\Users\Admin\AppData\Local\Temp\d508eaa581dec017516e41872b16df3c13fb7ceabf94e3d590a85512c3249b28N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10687.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10687.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35393.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48800.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18848.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60734.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65374.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28035.exe
        9⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60547.exe
        10⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20254.exe
        11⤵
        
        PID:9608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52866.exe
        11⤵
        
        PID:13528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43622.exe
        12⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12872.exe
        11⤵
        
        PID:18384
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 18384 -s 488
        12⤵
        Program crash
        
        PID:9668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38761.exe
        10⤵
        
        PID:10596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41341.exe
        10⤵
        
        PID:13976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24939.exe
        9⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22465.exe
        9⤵
        
        PID:12496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10197.exe
        9⤵
        
        PID:18252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24150.exe
        9⤵
        
        PID:18088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47265.exe
        9⤵
        
        PID:19436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55274.exe
        8⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19910.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:10912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        9⤵
        
        PID:15132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45472.exe
        9⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28858.exe
        8⤵
        
        PID:9308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53616.exe
        8⤵
        
        PID:15296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41337.exe
        8⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39177.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61091.exe
        8⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61315.exe
        9⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27995.exe
        10⤵
        
        PID:8652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        10⤵
        
        PID:15668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59561.exe
        10⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54405.exe
        9⤵
        
        PID:9932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21619.exe
        9⤵
        
        PID:14124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49682.exe
        9⤵
        
        PID:19076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48182.exe
        9⤵
        
        PID:18936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59537.exe
        8⤵
        
        PID:7672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20417.exe
        9⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56953.exe
        8⤵
        
        PID:11372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22540.exe
        8⤵
        
        PID:17964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37489.exe
        7⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15266.exe
        8⤵
        
        PID:8820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24588.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55913.exe
        8⤵
        
        PID:17864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        8⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57274.exe
        7⤵
        
        PID:8732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3043.exe
        7⤵
        
        PID:13072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8857.exe
        7⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31465.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36158.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54558.exe
        8⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6082.exe
        9⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25715.exe
        9⤵
        
        PID:11808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31506.exe
        9⤵
        
        PID:12640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47914.exe
        8⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34152.exe
        9⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12840.exe
        8⤵
        
        PID:12008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-337.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe
        8⤵
        
        PID:368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9161.exe
        7⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20960.exe
        8⤵
        
        PID:9884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43622.exe
        9⤵
        
        PID:18068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3852.exe
        8⤵
        
        PID:14020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-947.exe
        8⤵
        
        PID:19048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21265.exe
        8⤵
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3558.exe
        8⤵
        
        PID:18956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7211.exe
        7⤵
        
        PID:10076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36914.exe
        7⤵
        
        PID:14296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29859.exe
        7⤵
        
        PID:19172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56177.exe
        6⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28611.exe
        7⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40291.exe
        8⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65190.exe
        9⤵
        
        PID:15512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32780.exe
        9⤵
        
        PID:18920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44050.exe
        9⤵
        
        PID:17524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47666.exe
        8⤵
        
        PID:13036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30087.exe
        8⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37164.exe
        7⤵
        
        PID:9080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56189.exe
        7⤵
        
        PID:10300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39076.exe
        7⤵
        
        PID:17944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39788.exe
        7⤵
        
        PID:18380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40858.exe
        6⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28187.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        7⤵
        
        PID:15676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52828.exe
        6⤵
        
        PID:7488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22828.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39606.exe
        6⤵
        
        PID:17644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52702.exe
        6⤵
        
        PID:19440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65287.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51331.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28291.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46826.exe
        8⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14815.exe
        9⤵
        
        PID:9420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34028.exe
        9⤵
        
        PID:14412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31838.exe
        9⤵
        
        PID:18668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7792.exe
        8⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53616.exe
        8⤵
        
        PID:15136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15806.exe
        8⤵
        
        PID:18988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31558.exe
        7⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37979.exe
        8⤵
        
        PID:10940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        8⤵
        
        PID:15684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53696.exe
        8⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7792.exe
        7⤵
        
        PID:8372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19032.exe
        7⤵
        
        PID:13560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19567.exe
        7⤵
        
        PID:19352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15242.exe
        7⤵
        
        PID:19404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15152.exe
        7⤵
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16292.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53738.exe
        7⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12386.exe
        8⤵
        
        PID:9544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52866.exe
        8⤵
        
        PID:13432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62180.exe
        8⤵
        
        PID:19272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14817.exe
        8⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26219.exe
        7⤵
        
        PID:8696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45149.exe
        7⤵
        
        PID:13164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53113.exe
        7⤵
        
        PID:17912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
        7⤵
        
        PID:8028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
        6⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36003.exe
        7⤵
        
        PID:9132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23052.exe
        7⤵
        
        PID:12892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55913.exe
        7⤵
        
        PID:17832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32085.exe
        6⤵
        
        PID:8688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36483.exe
        6⤵
        
        PID:12992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36577.exe
        6⤵
        
        PID:17848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52300.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24259.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1885.exe
        7⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60355.exe
        8⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61798.exe
        9⤵
        
        PID:10888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:15652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31222.exe
        9⤵
        
        PID:18024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31352.exe
        9⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55941.exe
        8⤵
        
        PID:9792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53696.exe
        9⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8860.exe
        8⤵
        
        PID:12952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28422.exe
        8⤵
        
        PID:17424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32843.exe
        8⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29636.exe
        7⤵
        
        PID:7968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3357.exe
        8⤵
        
        PID:9528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47952.exe
        8⤵
        
        PID:14620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51825.exe
        7⤵
        
        PID:10356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59872.exe
        7⤵
        
        PID:14820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21257.exe
        6⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36195.exe
        7⤵
        
        PID:9068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36588.exe
        7⤵
        
        PID:11760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39392.exe
        7⤵
        
        PID:17688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5912.exe
        7⤵
        
        PID:18340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28858.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53616.exe
        6⤵
        
        PID:7552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36758.exe
        6⤵
        
        PID:3832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48094.exe
        6⤵
        
        PID:2944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27834.exe
        5⤵
        
        PID:572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40774.exe
        6⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39107.exe
        7⤵
        
        PID:10204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17313.exe
        7⤵
        
        PID:14312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64585.exe
        7⤵
        
        PID:19272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48374.exe
        7⤵
        
        PID:18772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41425.exe
        6⤵
        
        PID:8768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53042.exe
        6⤵
        
        PID:13140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34688.exe
        5⤵
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51814.exe
        6⤵
        
        PID:11148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        6⤵
        
        PID:15116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        6⤵
        
        PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22089.exe
        5⤵
        
        PID:2420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44907.exe
        5⤵
        
        PID:13048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32112.exe
        5⤵
        
        PID:17816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31399.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19009.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21342.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1373.exe
        7⤵
        
        PID:1004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4319.exe
        8⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32419.exe
        9⤵
        
        PID:7848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61912.exe
        10⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59753.exe
        9⤵
        
        PID:11648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47741.exe
        9⤵
        
        PID:18164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61004.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18790.exe
        9⤵
        
        PID:17424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25932.exe
        8⤵
        
        PID:13828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36633.exe
        8⤵
        
        PID:19396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17339.exe
        8⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5017.exe
        8⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31558.exe
        7⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25443.exe
        8⤵
        
        PID:8720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57645.exe
        8⤵
        
        PID:13088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55913.exe
        8⤵
        
        PID:18444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14527.exe
        8⤵
        
        PID:8892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        8⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7792.exe
        7⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54578.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14960.exe
        7⤵
        
        PID:7032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7657.exe
        6⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59934.exe
        7⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30115.exe
        8⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54662.exe
        9⤵
        
        PID:14700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37388.exe
        9⤵
        
        PID:17720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34152.exe
        9⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47666.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10544.exe
        8⤵
        
        PID:18096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12121.exe
        7⤵
        
        PID:9464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19020.exe
        7⤵
        
        PID:14852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28491.exe
        7⤵
        
        PID:8924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64977.exe
        6⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2754.exe
        7⤵
        
        PID:9056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36588.exe
        7⤵
        
        PID:10884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41876.exe
        7⤵
        
        PID:18096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14817.exe
        7⤵
        
        PID:2144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25173.exe
        6⤵
        
        PID:8480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59373.exe
        6⤵
        
        PID:13876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36633.exe
        6⤵
        
        PID:19404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59248.exe
        6⤵
        
        PID:19428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33081.exe
        6⤵
        
        PID:7392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49354.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22723.exe
        6⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13535.exe
        7⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17961.exe
        8⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34152.exe
        9⤵
        
        PID:19124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52829.exe
        8⤵
        
        PID:12632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39076.exe
        8⤵
        
        PID:18052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29895.exe
        8⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38638.exe
        7⤵
        
        PID:9092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26898.exe
        7⤵
        
        PID:13188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34695.exe
        7⤵
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62373.exe
        6⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27995.exe
        7⤵
        
        PID:11256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        7⤵
        
        PID:15620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60687.exe
        7⤵
        
        PID:18560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28858.exe
        6⤵
        
        PID:9272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21336.exe
        6⤵
        
        PID:14424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38416.exe
        6⤵
        
        PID:7396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21579.exe
        5⤵
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15113.exe
        6⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45630.exe
        7⤵
        
        PID:10152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17313.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38903.exe
        7⤵
        
        PID:19376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        7⤵
        
        PID:17836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7600.exe
        6⤵
        
        PID:8964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19032.exe
        6⤵
        
        PID:13972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45249.exe
        6⤵
        
        PID:19284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49610.exe
        6⤵
        
        PID:17964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42005.exe
        5⤵
        
        PID:1288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39875.exe
        6⤵
        
        PID:9332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19617.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44756.exe
        6⤵
        
        PID:18216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34360.exe
        6⤵
        
        PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4800.exe
        5⤵
        
        PID:8996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29377.exe
        5⤵
        
        PID:13148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41358.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48581.exe
        5⤵
        
        PID:788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62051.exe
        6⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49315.exe
        7⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48294.exe
        8⤵
        
        PID:12880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42177.exe
        8⤵
        
        PID:18684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40018.exe
        8⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36553.exe
        7⤵
        
        PID:9828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61687.exe
        7⤵
        
        PID:14612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8753.exe
        7⤵
        
        PID:408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58090.exe
        6⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56227.exe
        7⤵
        
        PID:9924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4648.exe
        7⤵
        
        PID:15332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32480.exe
        7⤵
        
        PID:18144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18849.exe
        7⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5613.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59872.exe
        6⤵
        
        PID:14792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37489.exe
        5⤵
        
        PID:6820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28187.exe
        6⤵
        
        PID:11200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        6⤵
        
        PID:15612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59753.exe
        6⤵
        
        PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47290.exe
        5⤵
        
        PID:2876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44377.exe
        5⤵
        
        PID:13040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36577.exe
        5⤵
        
        PID:17936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43573.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60958.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53411.exe
        6⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51402.exe
        7⤵
        
        PID:8772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64916.exe
        7⤵
        
        PID:10920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41298.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23814.exe
        7⤵
        
        PID:18100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37790.exe
        7⤵
        
        PID:18704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28713.exe
        6⤵
        
        PID:8312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27827.exe
        6⤵
        
        PID:10324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59549.exe
        6⤵
        
        PID:15380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58713.exe
        6⤵
        
        PID:18396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
        6⤵
        
        PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22025.exe
        5⤵
        
        PID:6604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4482.exe
        6⤵
        
        PID:8980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30732.exe
        6⤵
        
        PID:12908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35113.exe
        7⤵
        
        PID:7312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34360.exe
        6⤵
        
        PID:18040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21035.exe
        5⤵
        
        PID:8292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42653.exe
        5⤵
        
        PID:12720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39076.exe
        5⤵
        
        PID:18068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3553.exe
        5⤵
        
        PID:4180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4088.exe
        5⤵
        
        PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12448.exe
      4⤵
      PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58019.exe
        5⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48864.exe
        6⤵
        
        PID:7608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51092.exe
        6⤵
        
        PID:12324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47741.exe
        6⤵
        
        PID:18172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41380.exe
        5⤵
        
        PID:7744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46697.exe
        6⤵
        
        PID:18604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39960.exe
        6⤵
        
        PID:6324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8232.exe
        5⤵
        
        PID:10044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31101.exe
        5⤵
        
        PID:17324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16804.exe
      4⤵
      PID:5896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        5⤵
        
        PID:11476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40233.exe
        5⤵
        
        PID:14504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14817.exe
        5⤵
        
        PID:6104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5522.exe
      4⤵
      PID:9016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24912.exe
      4⤵
      PID:13128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26777.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:17824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10950.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10950.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46496.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53025.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45374.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24638.exe
        7⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53411.exe
        8⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14141.exe
        9⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50598.exe
        10⤵
        
        PID:12672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28140.exe
        10⤵
        
        PID:17680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47776.exe
        10⤵
        
        PID:17576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35384.exe
        10⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27916.exe
        9⤵
        
        PID:11384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64617.exe
        9⤵
        
        PID:15484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40018.exe
        9⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3915.exe
        8⤵
        
        PID:9020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56189.exe
        8⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39076.exe
        8⤵
        
        PID:17796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32075.exe
        8⤵
        
        PID:18580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24329.exe
        7⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22406.exe
        8⤵
        
        PID:11008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53072.exe
        8⤵
        
        PID:14464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17512.exe
        8⤵
        
        PID:19376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40018.exe
        8⤵
        
        PID:19208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7792.exe
        7⤵
        
        PID:9044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53616.exe
        7⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24344.exe
        7⤵
        
        PID:2604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30921.exe
        6⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6623.exe
        7⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62403.exe
        8⤵
        
        PID:8348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59046.exe
        9⤵
        
        PID:17464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51181.exe
        8⤵
        
        PID:10336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35433.exe
        8⤵
        
        PID:17364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34360.exe
        8⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56785.exe
        7⤵
        
        PID:9188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6111.exe
        7⤵
        
        PID:9404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39076.exe
        7⤵
        
        PID:17952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3553.exe
        7⤵
        
        PID:1212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37489.exe
        6⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20678.exe
        7⤵
        
        PID:10964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        7⤵
        
        PID:15628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53633.exe
        6⤵
        
        PID:9244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31595.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15227.exe
        6⤵
        
        PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23972.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21379.exe
        6⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60510.exe
        7⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48864.exe
        8⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41307.exe
        9⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34152.exe
        9⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35596.exe
        8⤵
        
        PID:10052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1270.exe
        8⤵
        
        PID:14392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23378.exe
        8⤵
        
        PID:19284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        8⤵
        
        PID:18648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9092.exe
        7⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15045.exe
        8⤵
        
        PID:12652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28140.exe
        8⤵
        
        PID:17660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        8⤵
        
        PID:10296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19388.exe
        7⤵
        
        PID:12600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39076.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22404.exe
        6⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20254.exe
        7⤵
        
        PID:9600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10956.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23933.exe
        7⤵
        
        PID:18268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14817.exe
        7⤵
        
        PID:18032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7600.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54578.exe
        6⤵
        
        PID:11300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15056.exe
        5⤵
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9695.exe
        6⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
        7⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31398.exe
        8⤵
        
        PID:13616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54285.exe
        8⤵
        
        PID:18480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47666.exe
        7⤵
        
        PID:13512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10072.exe
        7⤵
        
        PID:18368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1441.exe
        7⤵
        
        PID:18676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10352.exe
        7⤵
        
        PID:4916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61004.exe
        6⤵
        
        PID:9112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64274.exe
        6⤵
        
        PID:12180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40090.exe
        5⤵
        
        PID:6656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61243.exe
        6⤵
        
        PID:9256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        6⤵
        
        PID:15636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23419.exe
        5⤵
        
        PID:8704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16876.exe
        5⤵
        
        PID:12956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53643.exe
        5⤵
        
        PID:17808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42105.exe
        5⤵
        
        PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30855.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63075.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48291.exe
        6⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53598.exe
        7⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16222.exe
        8⤵
        
        PID:9284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58818.exe
        8⤵
        
        PID:13300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52098.exe
        8⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19526.exe
        7⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36788.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47741.exe
        7⤵
        
        PID:18132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22575.exe
        7⤵
        
        PID:18316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64238.exe
        6⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61603.exe
        7⤵
        
        PID:10432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57101.exe
        7⤵
        
        PID:15072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55156.exe
        7⤵
        
        PID:18324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        7⤵
        
        PID:18220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23096.exe
        6⤵
        
        PID:11516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27404.exe
        6⤵
        
        PID:15548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26500.exe
        5⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4413.exe
        6⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29417.exe
        7⤵
        
        PID:11524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33004.exe
        7⤵
        
        PID:15568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11368.exe
        7⤵
        
        PID:17704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59753.exe
        7⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38761.exe
        6⤵
        
        PID:10572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41341.exe
        6⤵
        
        PID:13452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32075.exe
        6⤵
        
        PID:17832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43372.exe
        5⤵
        
        PID:7948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21414.exe
        6⤵
        
        PID:14456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54690.exe
        6⤵
        
        PID:18500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24250.exe
        5⤵
        
        PID:10312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51207.exe
        5⤵
        
        PID:14808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31788.exe
        5⤵
        
        PID:17748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35404.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46366.exe
        5⤵
        
        PID:5868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49763.exe
        6⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16222.exe
        7⤵
        
        PID:8544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19617.exe
        7⤵
        
        PID:13328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44756.exe
        7⤵
        
        PID:18568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7300.exe
        6⤵
        
        PID:8280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34344.exe
        7⤵
        
        PID:376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7391.exe
        6⤵
        
        PID:13920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43015.exe
        6⤵
        
        PID:18776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13577.exe
        5⤵
        
        PID:7188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12962.exe
        6⤵
        
        PID:9624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52866.exe
        6⤵
        
        PID:13400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62180.exe
        6⤵
        
        PID:19264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34552.exe
        6⤵
        
        PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2716.exe
        5⤵
        
        PID:10536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
        5⤵
        
        PID:13380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47632.exe
        5⤵
        
        PID:15820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19414.exe
      4⤵
      PID:5144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46878.exe
        5⤵
        
        PID:6540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50819.exe
        6⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53888.exe
        7⤵
        
        PID:5204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58818.exe
        6⤵
        
        PID:13284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55913.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59753.exe
        6⤵
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17316.exe
        5⤵
        
        PID:9412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47764.exe
        5⤵
        
        PID:14440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14817.exe
        5⤵
        
        PID:2944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52092.exe
      4⤵
      PID:7852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28187.exe
        5⤵
        
        PID:11228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        5⤵
        
        PID:15056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9619.exe
        5⤵
        
        PID:9760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30953.exe
      4⤵
      PID:9904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59417.exe
      4⤵
      PID:14644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32600.exe
      4⤵
      PID:5260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45903.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45903.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12703.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46407.exe
        5⤵
        
        PID:5572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32062.exe
        6⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55717.exe
        7⤵
        
        PID:9032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16499.exe
        7⤵
        
        PID:12144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47741.exe
        7⤵
        
        PID:18180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22575.exe
        7⤵
        
        PID:220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32075.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12121.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18325.exe
        6⤵
        
        PID:13220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42297.exe
        6⤵
        
        PID:18072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28848.exe
        5⤵
        
        PID:7160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12386.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52866.exe
        6⤵
        
        PID:13424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23933.exe
        6⤵
        
        PID:18300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44218.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30552.exe
        5⤵
        
        PID:13356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25420.exe
        5⤵
        
        PID:18224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18110.exe
        5⤵
        
        PID:17448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24560.exe
        5⤵
        
        PID:5992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22436.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3421.exe
        5⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40099.exe
        6⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48699.exe
        7⤵
        
        PID:12756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64269.exe
        7⤵
        
        PID:18280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32312.exe
        7⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57812.exe
        6⤵
        
        PID:11696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31506.exe
        6⤵
        
        PID:14288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21999.exe
        6⤵
        
        PID:18240
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 18240 -s 276
        7⤵
        Program crash
        
        PID:18064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8900.exe
        5⤵
        
        PID:7652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19388.exe
        5⤵
        
        PID:12608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39076.exe
        5⤵
        
        PID:18076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3553.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37489.exe
      4⤵
      PID:6804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3714.exe
        5⤵
        
        PID:8936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58192.exe
        5⤵
        
        PID:12104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50537.exe
        5⤵
        
        PID:17568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52982.exe
        5⤵
        
        PID:18080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53633.exe
      4⤵
      PID:9260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2497.exe
      4⤵
      PID:13588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36633.exe
      4⤵
      PID:19388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44467.exe
      4⤵
      PID:17744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13398.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13398.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6941.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19262.exe
        5⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58211.exe
        6⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
        7⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51092.exe
        7⤵
        
        PID:12308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47741.exe
        7⤵
        
        PID:18124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61004.exe
        6⤵
        
        PID:9104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61490.exe
        6⤵
        
        PID:12584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39076.exe
        6⤵
        
        PID:18060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3745.exe
        6⤵
        
        PID:18804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19913.exe
        5⤵
        
        PID:6192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28358.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        6⤵
        
        PID:15660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        6⤵
        
        PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38353.exe
        5⤵
        
        PID:9428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39218.exe
        5⤵
        
        PID:13316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9667.exe
        5⤵
        
        PID:18340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51016.exe
        5⤵
        
        PID:17540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61482.exe
      4⤵
      PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8969.exe
        5⤵
        
        PID:6692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3933.exe
        6⤵
        
        PID:9632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8097.exe
        6⤵
        
        PID:13688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38903.exe
        6⤵
        
        PID:19368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe
        6⤵
        
        PID:19136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2716.exe
        5⤵
        
        PID:10544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
        5⤵
        
        PID:12752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11887.exe
        5⤵
        
        PID:17680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1447.exe
        5⤵
        
        PID:7056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29995.exe
      4⤵
      PID:6840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61243.exe
        5⤵
        
        PID:8576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        5⤵
        
        PID:14880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57588.exe
        5⤵
        
        PID:18580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40018.exe
        5⤵
        
        PID:18828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13076.exe
      4⤵
      PID:10068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28248.exe
      4⤵
      PID:14332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37932.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:19224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54145.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54145.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23870.exe
      4⤵
      PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20100.exe
        5⤵
        
        PID:7108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50238.exe
        6⤵
        
        PID:9676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10956.exe
        6⤵
        
        PID:13392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2716.exe
        5⤵
        
        PID:10760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65156.exe
        5⤵
        
        PID:14800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19692.exe
        5⤵
        
        PID:2364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36491.exe
        5⤵
        
        PID:6156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64238.exe
      4⤵
      PID:7800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12058.exe
        5⤵
        
        PID:12208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41484.exe
        5⤵
        
        PID:15288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46516.exe
        5⤵
        
        PID:18868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54618.exe
      4⤵
      PID:10032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58887.exe
      4⤵
      PID:14568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46096.exe
      4⤵
      PID:19344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62405.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62405.exe
    3⤵
    PID:5700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48227.exe
      4⤵
      PID:6372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18116.exe
        5⤵
        
        PID:7684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24667.exe
        6⤵
        
        PID:12552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28140.exe
        6⤵
        
        PID:17616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1368.exe
        6⤵
        
        PID:6348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12840.exe
        5⤵
        
        PID:12048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-337.exe
        5⤵
        
        PID:15720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51618.exe
        5⤵
        
        PID:1940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54058.exe
      4⤵
      PID:7268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17385.exe
        5⤵
        
        PID:15356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57039.exe
        5⤵
        
        PID:18124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63677.exe
      4⤵
      PID:11624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22840.exe
      4⤵
      PID:12976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48904.exe
      4⤵
      PID:18836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33870.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33870.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28187.exe
      4⤵
      PID:9616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63860.exe
      4⤵
      PID:17340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59753.exe
      4⤵
      PID:5208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47992.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47992.exe
    3⤵
    PID:9488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4217.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4217.exe
    3⤵
    PID:13340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53068.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53068.exe
    3⤵
    PID:18272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48826.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48826.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:12240
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19273.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19273.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30624.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30624.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46688.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64901.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2909.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26499.exe
        7⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32286.exe
        8⤵
        
        PID:7720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61603.exe
        9⤵
        
        PID:9568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47952.exe
        9⤵
        
        PID:14628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8681.exe
        8⤵
        
        PID:9504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10675.exe
        8⤵
        
        PID:13764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40068.exe
        8⤵
        
        PID:19232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51330.exe
        8⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51754.exe
        7⤵
        
        PID:7272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7962.exe
        8⤵
        
        PID:13596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23532.exe
        8⤵
        
        PID:17508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40018.exe
        8⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41652.exe
        7⤵
        
        PID:11376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4945.exe
        7⤵
        
        PID:15492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21257.exe
        6⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48323.exe
        7⤵
        
        PID:8872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21414.exe
        8⤵
        
        PID:14480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54690.exe
        8⤵
        
        PID:17596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62825.exe
        8⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7759.exe
        7⤵
        
        PID:13064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55913.exe
        7⤵
        
        PID:17856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55628.exe
        6⤵
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11322.exe
        7⤵
        
        PID:18952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9153.exe
        7⤵
        
        PID:19124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49254.exe
        7⤵
        
        PID:18920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48029.exe
        6⤵
        
        PID:12528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39076.exe
        6⤵
        
        PID:18036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39641.exe
        6⤵
        
        PID:18788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10544.exe
        6⤵
        
        PID:18712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43610.exe
        5⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61315.exe
        6⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18374.exe
        7⤵
        
        PID:11184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57986.exe
        7⤵
        
        PID:15044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59013.exe
        6⤵
        
        PID:10136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39613.exe
        6⤵
        
        PID:14600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3434.exe
        6⤵
        
        PID:15808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40572.exe
        5⤵
        
        PID:7960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
        6⤵
        
        PID:14552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33953.exe
        6⤵
        
        PID:492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44626.exe
        6⤵
        
        PID:6896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32489.exe
        5⤵
        
        PID:10348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51737.exe
        5⤵
        
        PID:14784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46497.exe
        5⤵
        
        PID:18804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30663.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2146.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61091.exe
        6⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48864.exe
        7⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3116.exe
        7⤵
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53460.exe
        7⤵
        
        PID:13296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10566.exe
        6⤵
        
        PID:8208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52829.exe
        6⤵
        
        PID:12624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39076.exe
        6⤵
        
        PID:18020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3745.exe
        6⤵
        
        PID:18992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22793.exe
        5⤵
        
        PID:6640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16222.exe
        6⤵
        
        PID:8424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61314.exe
        6⤵
        
        PID:5080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44756.exe
        6⤵
        
        PID:18236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50486.exe
        6⤵
        
        PID:18332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34360.exe
        6⤵
        
        PID:5812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51409.exe
        5⤵
        
        PID:8672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8636.exe
        5⤵
        
        PID:13196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53113.exe
        5⤵
        
        PID:17884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34552.exe
        5⤵
        
        PID:18408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29072.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8989.exe
        5⤵
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54496.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28358.exe
        7⤵
        
        PID:10928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        7⤵
        
        PID:15000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-326.exe
        6⤵
        
        PID:9780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22963.exe
        6⤵
        
        PID:13564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43133.exe
        6⤵
        
        PID:17500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5796.exe
        5⤵
        
        PID:7888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2074.exe
        6⤵
        
        PID:11396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28140.exe
        6⤵
        
        PID:17652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59561.exe
        6⤵
        
        PID:3228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55197.exe
        5⤵
        
        PID:11500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43940.exe
        5⤵
        
        PID:15556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22977.exe
        5⤵
        
        PID:5552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-852.exe
      4⤵
      PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60355.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39107.exe
        6⤵
        
        PID:10196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17313.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32659.exe
        6⤵
        
        PID:19160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32312.exe
        6⤵
        
        PID:18980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59013.exe
        5⤵
        
        PID:10128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31048.exe
        5⤵
        
        PID:13240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53216.exe
        5⤵
        
        PID:19132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43353.exe
        5⤵
        
        PID:18980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52560.exe
        5⤵
        
        PID:19128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2090.exe
        5⤵
        
        PID:6648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40572.exe
      4⤵
      PID:7976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6021.exe
        5⤵
        
        PID:13012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31020.exe
        5⤵
        
        PID:18204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36324.exe
      4⤵
      PID:10048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59417.exe
      4⤵
      PID:14660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-312.exe
      4⤵
      PID:7036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32167.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32167.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50529.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29635.exe
        5⤵
        Executes dropped EXE
        
        PID:4936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31876.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46499.exe
        6⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15678.exe
        7⤵
        
        PID:7284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11969.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46740.exe
        7⤵
        
        PID:16884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59561.exe
        7⤵
        
        PID:644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20550.exe
        6⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38491.exe
        7⤵
        
        PID:13964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3624.exe
        6⤵
        
        PID:12244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46560.exe
        6⤵
        
        PID:17308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36140.exe
        5⤵
        
        PID:7144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11005.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52048.exe
        6⤵
        
        PID:11684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14817.exe
        6⤵
        
        PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13465.exe
        5⤵
        
        PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45913.exe
        5⤵
        
        PID:13080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33675.exe
        5⤵
        
        PID:17700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17828.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47134.exe
        5⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53790.exe
        6⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35552.exe
        7⤵
        
        PID:8504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58818.exe
        7⤵
        
        PID:13272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41810.exe
        7⤵
        
        PID:18264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15009.exe
        7⤵
        
        PID:18328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33833.exe
        6⤵
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51785.exe
        6⤵
        
        PID:12384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47741.exe
        6⤵
        
        PID:18148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33950.exe
        6⤵
        
        PID:18408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64238.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22214.exe
        6⤵
        
        PID:10216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53072.exe
        6⤵
        
        PID:14496
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14496 -s 464
        7⤵
        Program crash
        
        PID:19200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17512.exe
        6⤵
        
        PID:19392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40210.exe
        6⤵
        
        PID:18168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56154.exe
        5⤵
        
        PID:9876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58887.exe
        5⤵
        
        PID:14556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65425.exe
      4⤵
      PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58398.exe
        5⤵
        
        PID:6528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54694.exe
        6⤵
        
        PID:9500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11141.exe
        7⤵
        
        PID:19156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31784.exe
        6⤵
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3864.exe
        6⤵
        
        PID:6868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19526.exe
        5⤵
        
        PID:8320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42164.exe
        5⤵
        
        PID:12520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47741.exe
        5⤵
        
        PID:18156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61050.exe
      4⤵
      PID:6912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60475.exe
        5⤵
        
        PID:11132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        5⤵
        
        PID:15644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23080.exe
        5⤵
        
        PID:18072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4411.exe
      4⤵
      PID:10060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34152.exe
        5⤵
        
        PID:5672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11713.exe
      4⤵
      PID:14320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41355.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:19096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56830.exe
      4⤵
      PID:19368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42297.exe
      4⤵
      PID:7560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7341.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7341.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15327.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22334.exe
        5⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53790.exe
        6⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54878.exe
        7⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2650.exe
        8⤵
        
        PID:12352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28140.exe
        8⤵
        
        PID:17624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31544.exe
        8⤵
        
        PID:18472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38089.exe
        7⤵
        
        PID:10340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51703.exe
        7⤵
        
        PID:13836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34360.exe
        7⤵
        
        PID:17424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19652.exe
        6⤵
        
        PID:7496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10149.exe
        7⤵
        
        PID:17456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39540.exe
        6⤵
        
        PID:11312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37426.exe
        6⤵
        
        PID:15448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36446.exe
        6⤵
        
        PID:18888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19913.exe
        5⤵
        
        PID:6212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22214.exe
        6⤵
        
        PID:11128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53072.exe
        6⤵
        
        PID:13712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13739.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6256.exe
        5⤵
        
        PID:9476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38491.exe
        6⤵
        
        PID:15740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40018.exe
        6⤵
        
        PID:5344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39218.exe
        5⤵
        
        PID:13176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47632.exe
        5⤵
        
        PID:6924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26500.exe
      4⤵
      PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20100.exe
        5⤵
        
        PID:7100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18124.exe
        6⤵
        
        PID:9972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59060.exe
        6⤵
        
        PID:10104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28754.exe
        6⤵
        
        PID:6992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3558.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27230.exe
        6⤵
        
        PID:7420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2716.exe
        5⤵
        
        PID:10528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
        5⤵
        
        PID:9996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10544.exe
        5⤵
        
        PID:1544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64977.exe
      4⤵
      PID:6020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29123.exe
        5⤵
        
        PID:9368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34028.exe
        5⤵
        
        PID:14396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56500.exe
        5⤵
        
        PID:19424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23378.exe
        5⤵
        
        PID:17164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25173.exe
      4⤵
      PID:6548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4216.exe
      4⤵
      PID:11840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28400.exe
      4⤵
      PID:832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18902.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18902.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe
      4⤵
      PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61315.exe
        5⤵
        
        PID:6304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28358.exe
        6⤵
        
        PID:10868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        6⤵
        
        PID:14992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38761.exe
        5⤵
        
        PID:10556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41341.exe
        5⤵
        
        PID:13444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17748.exe
      4⤵
      PID:8828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34843.exe
        5⤵
        
        PID:13656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34152.exe
        5⤵
        
        PID:2260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62116.exe
      4⤵
      PID:10096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39724.exe
      4⤵
      PID:1304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19680.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19680.exe
    3⤵
    PID:5816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
      4⤵
      PID:7864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9125.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40018.exe
        5⤵
        
        PID:19092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51092.exe
      4⤵
      PID:12316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47741.exe
      4⤵
      PID:18140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31883.exe
      4⤵
      PID:7004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4966.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4966.exe
    3⤵
    PID:8200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41449.exe
      4⤵
      PID:17428
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 17428 -s 472
        5⤵
        Program crash
        
        PID:18088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34198.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34198.exe
    3⤵
    PID:11996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36208.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36208.exe
    3⤵
    PID:15708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2087.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2087.exe
    3⤵
    PID:18036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46959.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46959.exe
    3⤵
    PID:1436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9545.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9545.exe
    3⤵
    PID:7120
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57742.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57742.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46496.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46496.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45952.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2146.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18144.exe
        6⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32867.exe
        7⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17120.exe
        8⤵
        
        PID:9584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47952.exe
        8⤵
        
        PID:14576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2888.exe
        8⤵
        
        PID:17480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38761.exe
        7⤵
        
        PID:10580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37501.exe
        7⤵
        
        PID:14120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21807.exe
        7⤵
        
        PID:17572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22977.exe
        7⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44359.exe
        6⤵
        
        PID:8008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61603.exe
        7⤵
        
        PID:9708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47952.exe
        7⤵
        
        PID:14604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2888.exe
        7⤵
        
        PID:18248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        7⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23371.exe
        6⤵
        
        PID:10108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2015.exe
        6⤵
        
        PID:14652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46412.exe
        6⤵
        
        PID:4784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3434.exe
        6⤵
        
        PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51397.exe
        5⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5599.exe
        6⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27163.exe
        7⤵
        
        PID:12688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28140.exe
        7⤵
        
        PID:17580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59124.exe
        7⤵
        
        PID:18516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59561.exe
        7⤵
        
        PID:18876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36553.exe
        6⤵
        
        PID:9820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61687.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8753.exe
        6⤵
        
        PID:17608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35697.exe
        5⤵
        
        PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47517.exe
        5⤵
        
        PID:11324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28760.exe
        5⤵
        
        PID:15432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11887.exe
        5⤵
        
        PID:18172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15337.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9757.exe
        5⤵
        
        PID:1644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63427.exe
        6⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24859.exe
        7⤵
        
        PID:12928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51088.exe
        7⤵
        
        PID:3028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9257.exe
        6⤵
        
        PID:9220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21832.exe
        6⤵
        
        PID:13988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44768.exe
        6⤵
        
        PID:19360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14712.exe
        6⤵
        
        PID:19288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15009.exe
        6⤵
        
        PID:18332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58090.exe
        5⤵
        
        PID:8104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12962.exe
        6⤵
        
        PID:9636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53888.exe
        7⤵
        
        PID:17664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19617.exe
        6⤵
        
        PID:13364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12467.exe
        6⤵
        
        PID:18348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34360.exe
        6⤵
        
        PID:5284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5613.exe
        5⤵
        
        PID:10260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59872.exe
        5⤵
        
        PID:14828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48324.exe
        5⤵
        
        PID:17780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50732.exe
      4⤵
      PID:6560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2754.exe
        5⤵
        
        PID:9048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53805.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55913.exe
        5⤵
        
        PID:17928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61493.exe
      4⤵
      PID:8376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64932.exe
      4⤵
      PID:12916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36577.exe
      4⤵
      PID:17840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48400.exe
      4⤵
      PID:6760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59143.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59143.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8941.exe
      4⤵
      PID:5636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14141.exe
        5⤵
        
        PID:7480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64642.exe
        5⤵
        
        PID:12096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22163.exe
        5⤵
        
        PID:1708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40978.exe
        5⤵
        
        PID:7436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60981.exe
      4⤵
      PID:7732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40417.exe
      4⤵
      PID:11320
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11320 -s 464
        5⤵
        Program crash
        
        PID:15340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39606.exe
      4⤵
      PID:17600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5209.exe
      4⤵
      PID:18628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28880.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28880.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33598.exe
      4⤵
      PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41822.exe
        5⤵
        
        PID:7704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22732.exe
        5⤵
        
        PID:12024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32360.exe
        5⤵
        
        PID:13224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58930.exe
        5⤵
        
        PID:18120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51906.exe
        5⤵
        
        PID:1704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3524.exe
      4⤵
      PID:8332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31859.exe
      4⤵
      PID:10508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64925.exe
      4⤵
      PID:15228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20088.exe
      4⤵
      PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32075.exe
      4⤵
      PID:18704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61911.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61911.exe
    3⤵
    PID:6744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27104.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58818.exe
      4⤵
      PID:13308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51906.exe
      4⤵
      PID:19052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22075.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22075.exe
    3⤵
    PID:8684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10586.exe
      4⤵
      PID:15348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40018.exe
      4⤵
      PID:5916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19948.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19948.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:12980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53643.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53643.exe
    3⤵
    PID:17920
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51768.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51768.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44992.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44992.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34435.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43683.exe
        5⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63427.exe
        6⤵
        
        PID:7204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28187.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        7⤵
        
        PID:15068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53065.exe
        7⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31544.exe
        7⤵
        
        PID:8860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62388.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41341.exe
        6⤵
        
        PID:13292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28422.exe
        6⤵
        
        PID:18252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58090.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15963.exe
        6⤵
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57506.exe
        6⤵
        
        PID:580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18384.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59872.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3626.exe
        5⤵
        
        PID:7088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51397.exe
      4⤵
      PID:5656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38942.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25804.exe
        5⤵
        
        PID:11360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46740.exe
        5⤵
        
        PID:15528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37088.exe
        5⤵
        
        PID:18156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2214.exe
        5⤵
        
        PID:19208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24301.exe
      4⤵
      PID:4468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18705.exe
      4⤵
      PID:12040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57209.exe
      4⤵
      PID:15728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15145.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15145.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6685.exe
      4⤵
      PID:6092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30115.exe
        5⤵
        
        PID:7928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5756.exe
        5⤵
        
        PID:11344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36004.exe
      4⤵
      PID:8284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13146.exe
        5⤵
        
        PID:13260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        5⤵
        
        PID:18812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63401.exe
        5⤵
        
        PID:392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27827.exe
      4⤵
      PID:10996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61085.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:17388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51426.exe
      4⤵
      PID:5804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55916.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55916.exe
    3⤵
    PID:2248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48926.exe
      4⤵
      PID:6244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45917.exe
      4⤵
      PID:13120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53113.exe
      4⤵
      PID:17892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22977.exe
      4⤵
      PID:492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30229.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30229.exe
    3⤵
    PID:6488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10040.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10040.exe
    3⤵
    PID:11980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40673.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40673.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:15744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53896.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53896.exe
    3⤵
    PID:17832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57767.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57767.exe
    3⤵
    PID:7244
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3773.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3773.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19168.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19168.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31875.exe
      4⤵
      PID:6076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11325.exe
        5⤵
        
        PID:6292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61243.exe
        6⤵
        
        PID:11240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        6⤵
        
        PID:15160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31222.exe
        6⤵
        
        PID:18236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38761.exe
        5⤵
        
        PID:10564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41341.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4394.exe
        5⤵
        
        PID:17416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5796.exe
      4⤵
      PID:7880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57990.exe
        5⤵
        
        PID:11352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28140.exe
        5⤵
        
        PID:17668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64989.exe
        5⤵
        
        PID:18108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48561.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2015.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46412.exe
      4⤵
      PID:17724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13732.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13732.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6717.exe
      4⤵
      PID:5976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55654.exe
        5⤵
        
        PID:10256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62900.exe
        5⤵
        
        PID:17328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52381.exe
        5⤵
        
        PID:18884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15009.exe
        5⤵
        
        PID:5156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38761.exe
      4⤵
      PID:10588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41341.exe
      4⤵
      PID:14588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43716.exe
      4⤵
      PID:19044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15009.exe
      4⤵
      PID:5160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe
    3⤵
    PID:8016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28731.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8172.exe
      4⤵
      PID:18212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57588.exe
      4⤵
      PID:18628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12529.exe
      4⤵
      PID:7028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13475.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13475.exe
    3⤵
    PID:11332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12225.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12225.exe
    3⤵
    PID:15424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42105.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42105.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8228
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16836.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16836.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8989.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8989.exe
    3⤵
    PID:6048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46878.exe
      4⤵
      PID:6740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28187.exe
        5⤵
        
        PID:11208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
        5⤵
        
        PID:15084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21679.exe
        5⤵
        
        PID:7080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17316.exe
      4⤵
      PID:9384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47764.exe
      4⤵
      PID:14384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20271.exe
      4⤵
      PID:18280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41156.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41156.exe
    3⤵
    PID:7868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28187.exe
      4⤵
      PID:11216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
      4⤵
      PID:15008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26614.exe
      4⤵
      PID:8308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31544.exe
      4⤵
      PID:17672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31762.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31762.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:11440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43940.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43940.exe
    3⤵
    PID:15540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21804.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21804.exe
    3⤵
    PID:18360
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62862.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62862.exe
  2⤵
  PID:5684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54115.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54115.exe
    3⤵
    PID:7840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35561.exe
      4⤵
      PID:9896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39724.exe
      4⤵
      PID:14112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17512.exe
      4⤵
      PID:15540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59561.exe
      4⤵
      PID:5288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2345.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2345.exe
    3⤵
    PID:10124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61687.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61687.exe
    3⤵
    PID:14540
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39955.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39955.exe
  2⤵
  PID:7508
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43460.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43460.exe
  2⤵
  PID:10244
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39873.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39873.exe
  2⤵
  PID:15464
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1329.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1329.exe
  2⤵
  PID:6440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4336,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8
1⤵
PID:2316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 11320 -ip 11320
1⤵
PID:14720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 15540 -ip 15540
1⤵
PID:19116

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10687.exe

Filesize
468KB

MD5
d724bd5f13a72ee9c85d656ef5c107c2

SHA1
3ae1a072807f0700c80e5300f57b6f4790782d16

SHA256
362619c20a2851a2286c2479da26988215f04ced6592164f99b73b3e31df72a0

SHA512
ac22cd50a95082f61c2675f97b4891d27db19e56d8d4a5048ac5ac59ab83f49b08eb54c711446dc31ca7d1d2c9d7e379cb729a23e796c6ef6088a272ba1eccbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-10950.exe

Filesize
468KB

MD5
11bbd9bfc448bb90c22c0c95f2c8fedf

SHA1
ca2666bec3c52f65b0bfb49694be3598e3a7bfa0

SHA256
e5919476ad4f8bf2f8d5e38932863cf1abdf0264d6cfce6cb7d180e4082b3e0f

SHA512
7343a675fe526c87c9d1cfd5e33c3ae9a7ce43469740e5d53fe64289e2ced33edec6b0d2a31920470bbf598224cec7583e5b7ecc9502c47632dee13fa9038f34

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12703.exe

Filesize
468KB

MD5
4073084b7b1218b05182be628f9118d0

SHA1
d308f50397d62452985655a78c759d658e2effea

SHA256
fc10a93ad35b35dce9ba46c07c8304ea7ea5d9687caf14609b5d11cc72a64a0c

SHA512
09f9cb7feba88d9479db21e8688aa8aab0b88de5eb95219fb7172fe1102d0952cc445c79890c1a2559224a7121d8c1d11ada507858352e9ada54740a976979a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13398.exe

Filesize
468KB

MD5
47d9d2867fa87b32c94c7b93f2667172

SHA1
579405647796224a11251569fc6b550043fd1d80

SHA256
ab879e44203b9dcf164d84cdfeb7ac996e547aa5e20c5e119a9c1e0ec3a42f1e

SHA512
bfbb40d6ca41c0e1469cf5320d6e5dd074b14ffba91f4a1ab35d5590e07125c9a5755e9e90311d6fdca57f4f2f108b7a982c1c06bc9d0fd0879d2d18e9faaa2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18848.exe

Filesize
468KB

MD5
11e1233f6921df321f0866b96640bc0d

SHA1
0000aa17550601b9fbcbf494d688907a03098468

SHA256
bcba372720d2978713765a4bd22046a6cfd003da9984ae8b2d1976abd70f3ad0

SHA512
9f2be73a8cece97c97d37c85036c28a237be8d0078d371a79fa6c9655c721dce20a6cec1298851cb91af51748efb3f52c54ec75a49df27236df5ccefe584df09

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19009.exe

Filesize
468KB

MD5
c4c1d87bfef9ba09665057af57f1cca4

SHA1
4e283400592452aea968d6acce14c7df2e8c4903

SHA256
9a121dd7073a925bf788f21ddf0b1d26594282973baadf83340be7ba2ab63d8c

SHA512
db79c84f3c80ed0dec006739b754bff6085f794939da70b170f369ab1c1d0c1df243b3e3e8cfeafdb1394dcbb3bdb907dee16af79cb75395f4c47f2343b8627f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19273.exe

Filesize
468KB

MD5
afff16b71a0a516563ed38e9ee3bf535

SHA1
d5dd4d55da2138b86f01b3ea8f76d7f0367ce4ec

SHA256
d3b69dcd073d0b8226c63fdb5e47cc985457274ec0862c7271b9bee814479e84

SHA512
e10a41e2a7d1f81220260cc64bbec27d11ddf68abc748b93f90ca40be13e2c9622762d446908278dbf1e3269374dd046bf5c2dafbfe1476fe3e2da57c1c9d77b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30624.exe

Filesize
468KB

MD5
f04ba9b67164b5bae2385917d05d61a6

SHA1
a165efd7391a1905477cc557a3203918570402c9

SHA256
6d381bce0dc15a5fa6d05647b8364b16d0877112c7ba20442c1a05e03e4d1c11

SHA512
05c8f355f4a6a130bd0c649b7a1f0e4e89393dc04fdfcbed4933dfadb2278e104da0263c9422ae79a270ffe4a4d1914cebd1766d16d3aa3ed70ef3a4cc1e9f48

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30663.exe

Filesize
468KB

MD5
afaa64d4c0f3cacf93d3780f87c2e9bc

SHA1
0af522a73581f6ffd3cd1e3330244c3aec4b9591

SHA256
50d74f97dcf14fe694fdc79a024d83edb0c1659dfd20b9e8b060ae64af3dfb39

SHA512
6f922730c034a928cd695a66d7b41f94bfbe221d7f17726b65bd167e38ddddac38d743ae5e5d343636978f577a5df6d5390386749af18a0390ad7b0947d94742

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30855.exe

Filesize
468KB

MD5
4edfacea8debad130c12b5ed9b5810c6

SHA1
07eee970a77f4b755b7134161c015122b8dbab90

SHA256
3f2a44c66a512b7f8159a7a99dc895f7fdd2238782e832b62df777ac6e15cc5a

SHA512
75b3dbf05a105f4d7fd603e47286bfec4042f640277534789eb4721519bf8d57a097a2f40e4736f5e6567eb4686dbd87742a616f193dea1e74944d0b7c092329

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31399.exe

Filesize
468KB

MD5
328fa72614955c638c4162c30c4395d4

SHA1
a0c47b99544785e1b3427d2d38157172382d7d3a

SHA256
c0e72c346051178165ba32046d7815898f48559d3dc83308e9f4e4c568746a29

SHA512
b041432da32e1f86c712fabcbc8cc6e17b39b9c5e128363b0bad7b569bf5e11917773a5d4950e2dcc0fffe41dcfb6b5b2625fd318f9aa8dbe51c87fc545274a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32167.exe

Filesize
468KB

MD5
6e79caacf34dc7398ed35dfdf16025dd

SHA1
cbcefb7102267aa9886f2007d44afcf32881e0b1

SHA256
a1feec87f6a231d080dc8c5f71f21f15752befac678fe8fec4d4c25f4f0afe35

SHA512
42dada67e0fe174e2b391acc72ba343319d8c45d007c863a92051a5257559578e0c62b14bd1568071f0c8cd5698e0324582744a520d789c5220057ef8c850944

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35393.exe

Filesize
468KB

MD5
e5660a5660065f75a2812ecd6bf8d5c7

SHA1
a0bf86e3e261d4d73a224c60c30553d61b41801f

SHA256
17c83be537e1af2dc2d3d0f7c528f635701b366383b395ff8c08f17a1c0d2fc1

SHA512
dc6c066840c0c7aa2aac18a5e2c211b67901e038810673f1790dafacdec1cc38efb021877028a9aa20e3e310baa48a8e9d339f13403ed8352b258d0ae9f8abad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3773.exe

Filesize
468KB

MD5
80aa9b1419c6b0fda239bbae5d9aaf6a

SHA1
a49e193b422d79af2a02938c0fc6dd88ef45e8b6

SHA256
5f67c98402c80034d313d641d2b69f8e5dd848f140aefcfe873a8e5975536f8d

SHA512
d190c2d71304082a91d1f55e218a91b9f2d250f101f781a550372685458a76bf88f7522a46b56431639b1f5983066dee3cff5d0b977f78e8a6f031cf433d82da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41358.exe

Filesize
468KB

MD5
a0aefa9ee4faa4e8c5a23bc3965ed31c

SHA1
1de2284271e0a0dbe68b075b388f02af3013fbcb

SHA256
7916a7881f06cdc2174cbdf5f8393c43b90c3c2eb3b2e4e4783c073e792aff55

SHA512
df3591a9e462f9f05ff06c9c6a81510eb383be996b5619761e4a528629e71eed8bbe5bc52bd5e7050d6c832fcaff35d372a2b72fea16262bc2a226b2ecf1ee24

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44992.exe

Filesize
468KB

MD5
8e93cc1e966444a177feda1b4a29f15a

SHA1
e9eda459844b9383e466c7a7ae6c0fe7f2313cf1

SHA256
7434293d525aac9e9b551827d60fdfbfeab486076f8228c1e4ec2cdc088004cd

SHA512
d94ab19f46adc5ddb865aeb0caa8db1444703be6e1a49724e6050759a3bbcf68d80bb63a22127632b315a25e924d0629889b1124bf101b3085bb296b074e5a56

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45903.exe

Filesize
468KB

MD5
379c4638a535e78ba592a2834940e499

SHA1
8daf47b6ba537d0cc8eebdccb18f09ae5301783b

SHA256
eff7b10ed8b68711e03d1f8de26758e991097659a42a50fcd81e78e3fad03df0

SHA512
b19d1dc1abe4e041fd51dbb81e20a113728e4835a12cf43015ccbdad28db0e19256343746b0c9798c2b5f1170c9a7a6f44856e62210e5439c6c04df44f3d30cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45952.exe

Filesize
468KB

MD5
2c0fc15f621839ec23a57864e0e7f3b7

SHA1
dda090ca0ad1134000ee8a13b70ebc3f2abc1dbd

SHA256
227aa1e71f9d7948ba8c4526b7827c66318dca4ec2e21b735afe25102d4189b1

SHA512
18016328bd6e8aa4de8a3557bba66986b5211a5d19e0262e9b7bebe67ca4f6c048d656c87efbf9f7901aa35a0497fe3965915bded1a7eac933d83be461a221f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46496.exe

Filesize
468KB

MD5
c7f5d12af858d588ef33b8f0afb059ac

SHA1
cee6278715d0c498916cf827297f1885ee8ff512

SHA256
e11c92ca3640eabaa08db67718b47e0b4b1e976dce1122e1bc25fab6f7e5d82a

SHA512
2a24e63c02e4327ebac3a7623e9f7fa70ee0a149ceca044b8dacd49c38a40368f8bd78401e37670002acea9afc19d73e3892a950dff2896952977ad7e1db2d57

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46688.exe

Filesize
468KB

MD5
b58615b512ba4f23a49f3309a1f0a62a

SHA1
48f743d36882695c2412b953e1f36a0b2d402f64

SHA256
a5d2ff8b01300ea7aeda6c472cc15ac86d200fa6578d2bfc47af5aca344c3afa

SHA512
044f79e337fe20403cb34d367ab5a0e3479bf08df3d8b772cd24b903acdd195f449e2972bd80ad49c778b7870d1387180c619c16f3752a110fff964486c3ff2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48800.exe

Filesize
468KB

MD5
bd8088574babb610beb351b3fea3dbda

SHA1
6b7063c286ecfc02120dddec6879312117ea0bdf

SHA256
2c3b112c3f15bd3dd164f3652ea2bf0655306dda532bb2f3c783be048909a9b3

SHA512
6c3fc56525d893bc35d168cdc7dfb893eecd95f62b31623feb744f29d09b3a2cfcc8dd78f349c5bfa363c21178b286a0e6b0a3575a1778fa2b08841792869122

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50529.exe

Filesize
468KB

MD5
d5a6c2c463ab5b9e1216d54e95aeb4be

SHA1
7abe3a0f39c381cce62f917d80d3d1d50af21b49

SHA256
e3024da1dcb23e832a937c067f62eb95456858717267e27d8a263e92a6497a81

SHA512
d8b1d9b7aaa1f515590c1976ebf769dd13cacaf22b4deb6f318c78b472acab7082c9a6e3857cf2665b0c5b540ec1e94ec52062b4b168ce34a30b8fc5f99b95c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51331.exe

Filesize
468KB

MD5
d3fb2e6d86da0fcff8413e9cd78c53a9

SHA1
5808143863518daca1c48fa4d899948d898802b0

SHA256
485bddf9518432cf11f16b5e268b7ab614244d0b6247f6c4a7aceb95934f0133

SHA512
bc66b1b1ca02919e60c05cebd162d9705ff386fe897f61c6845d39ee16b57c6f8b9bdb5e5574a067539745a569ebc1251deebe00a8bae1abddcafb2ffc88a87a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51768.exe

Filesize
468KB

MD5
94983ca61da87c57d0732bb8cc6196be

SHA1
fc3aa785bab683fcda48ca88ed80b6e6d2eb17ef

SHA256
4fcdb07e5f9d9209aed227d04e8a04886f985a6bfd304b4a5f0e5f72d3a1c782

SHA512
110b2bde5bc2a4f60c8f21ae5744bef402b406951d43622d04999e54f7abdc0b6bd5965bdd962bae25498c7898dce40c546410f14454d168b061a14380a1fc40

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52829.exe

Filesize
468KB

MD5
22b92da3318c295b33b214817e8d9f0c

SHA1
61dcee55b0171de5c2710652ad6ac0bd1dab532b

SHA256
91d2752d1ce4062819e8e000543fe94da0ac02c2346c1d94249928acaafb14b1

SHA512
3f8fde42475ee75390711a9d6ac8e18ba6aaf334a457b306c99a926cfd5312afe797ca7935db5c3d647dbf626a2746cdf93ea66313443225022cf8e8033634bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53025.exe

Filesize
468KB

MD5
a7379bdacf0bbea1941017b751563a48

SHA1
5aa18dce37b3145778022344963c98d44e8cf73c

SHA256
8430239f86b18fa464f579aad96c329c82f8c4ccc6f3684b9c4123bf33d866a4

SHA512
efd119234603012175cb4c83d086b94535c6db01dd12c0c02ab396342fd3fee2bdcffe46505c300837d988b01789d0fd2b9e1573748cd2ab62b96955cd771f13

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57742.exe

Filesize
468KB

MD5
f7ea24c7e3d7c6ae5dde4cd4b7fc823b

SHA1
52853e05eba47c05b2da3b5323841d62ca9b8d54

SHA256
045f9158e29b40fed2f98f59097b2a1a8288a8ff82a3ee1758c4b66c5cf8c167

SHA512
6e60b5f422230d35fc617e3b4eca561c499dfcb20b49447e80222ff6e4649dff78b7f709f5bb5a38b8fd73b0325eb6e7e388937624b82642da476217b3663cc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe

Filesize
468KB

MD5
eef28e83df1bc4470a2eded59b5e1c5d

SHA1
26225362668bc52eeeea46b270c7007c55ca584a

SHA256
dfdc68d17cb881a01401a8c4c4ef147e9c55c5081343600fc8bb454169c8821f

SHA512
66fdd4349fe0f27c9f5192448da7ca318c3066bcbe14afa40af2085ddd70bc23da112f1ad37578cdb5809c3913f3d7adb0b9ed96e0fa0d81f6ce23c8390649ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59143.exe

Filesize
468KB

MD5
cbc574a886274c48adb41479ac8dcd0f

SHA1
bd13436662d6a4fa0f0bdaf487a2370c4e78b605

SHA256
85fd20e70bd27bae4df6d469134ae27d894a299e354df9441da4850ff9d5fbde

SHA512
797ee03d6810806d5a9f820c6f7a28e67ba1b40ba57fa8f480093c3c55a976ba158e5fc621459cba4785c0f22570899d20db94e22e8095e1b1b0e72a296023d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60734.exe

Filesize
468KB

MD5
80a57d75b3276311567e0cde0da2f586

SHA1
8ba1d12b6edb82ecd811c7363f7f2974a8db2838

SHA256
b09efb51ab65ac117fafae5dde5e516d25643dcf58a290884848f737eeff1a11

SHA512
b7a9bcff654cc68e84242fe9694acf89a76bcb19ba2868b0a41eddf9a2dcb56ab1e56a87ad45534fab973472d1c4a0b73b9c41220ac884959f6a7cd1cab3ac69

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65287.exe

Filesize
468KB

MD5
dd793ea33431bd7637aab2d8d6fe39ea

SHA1
5a9e44dc2b68e5737388208b573d45ae0f21358b

SHA256
b5b8a99d395fe96720b2c4877914795261212c3368d025cc3f72be13037787fd

SHA512
27fff25a05ce5d1f8b32ad5cb1e3e93cc96f09af8fdf49c95621e8b28f63f60381682963924e88b1c96dc80045863721edba3c986c54c7bcbcc004193d545a8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7341.exe

Filesize
468KB

MD5
e345d99d62554795661768e067dd825b

SHA1
f4fbc4791a12926f62f304479aa9047e33cb08c8

SHA256
21c2fab319bd86ede85f2f62d612e05fac98c95ca441abe60a0aa8183160634c

SHA512
64b8c28c82d4b507fb4ef5ca29eb56ef0c99d91358a975a9ae9aac262bbf3cd4574642488ef7a13d1b03378b058b4606708fd7e1a433e94e469220c80db2aaa4

Download Submit
memory/17448-3031-0x00007FF854E80000-0x00007FF854ED9000-memory.dmp

Filesize
356KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads