d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4c

Analysis

max time kernel
106s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2024, 00:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe
Size

468KB
MD5

a320de90b3b8f3e682a53e313c7c48b0
SHA1

d9a5d7692bd7ab648a00e0db57a13071104bf63d
SHA256

d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4c
SHA512

f86aaceef168715d287becdf6f511da394d8e50bebd76832389286f5dd2d158c7a668648c3283a99ed3205cbc72c976fda72fbc5346f98cc3ad98405c421783a
SSDEEP

3072:1GeHo5IKq05UDbYpH5cOcf8/LC2WP0p1nLHewVPPXPH+tSgsvzlA:1Guoe8UDuHSOcfjYIsXPe0gsv

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
5076	Unicorn-11474.exe
468	Unicorn-47638.exe
4128	Unicorn-39173.exe
2960	Unicorn-45654.exe
448	Unicorn-40069.exe
3644	Unicorn-57823.exe
4984	Unicorn-52269.exe
3284	Unicorn-49695.exe
540	Unicorn-47583.exe
2364	Unicorn-27747.exe
4696	Unicorn-14012.exe
3528	Unicorn-39114.exe
2120	Unicorn-39114.exe
3876	Unicorn-1459.exe
1956	Unicorn-21059.exe
1480	Unicorn-61642.exe
2260	Unicorn-61629.exe
220	Unicorn-18070.exe
3024	Unicorn-11363.exe
4520	Unicorn-62221.exe
744	Unicorn-42931.exe
4312	Unicorn-4583.exe
800	Unicorn-13513.exe
1372	Unicorn-13513.exe
4140	Unicorn-20460.exe
3968	Unicorn-26326.exe
1944	Unicorn-26591.exe
2828	Unicorn-26591.exe
672	Unicorn-63793.exe
4384	Unicorn-43094.exe
2464	Unicorn-10675.exe
4632	Unicorn-28442.exe
4748	Unicorn-34573.exe
2876	Unicorn-5491.exe
336	Unicorn-40664.exe
2160	Unicorn-14814.exe
3872	Unicorn-1109.exe
4552	Unicorn-6869.exe
3248	Unicorn-39100.exe
2152	Unicorn-62614.exe
2812	Unicorn-29619.exe
4968	Unicorn-51286.exe
4652	Unicorn-38733.exe
380	Unicorn-49764.exe
4684	Unicorn-30428.exe
1428	Unicorn-4638.exe
1524	Unicorn-2526.exe
1760	Unicorn-54358.exe
4008	Unicorn-20892.exe
2348	Unicorn-40517.exe
1032	Unicorn-51453.exe
4016	Unicorn-7081.exe
2560	Unicorn-58883.exe
4404	Unicorn-51649.exe
1168	Unicorn-47135.exe
3288	Unicorn-22832.exe
3556	Unicorn-49631.exe
4820	Unicorn-22691.exe
2004	Unicorn-2459.exe
1476	Unicorn-27981.exe
1932	Unicorn-33482.exe
4300	Unicorn-26710.exe
3344	Unicorn-31946.exe
612	Unicorn-8026.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
14288	10404	WerFault.exe	560

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3699.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15984.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21837.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61404.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30551.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19657.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3407.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51213.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48067.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35585.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42169.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13781.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17942.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56450.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27747.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11452.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29916.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11047.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6615.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1744.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60252.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37334.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-460.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25559.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23868.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51286.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5897.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23775.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43035.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42931.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49930.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46313.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23743.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4553.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60210.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60202.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18624.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14592.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36569.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31684.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49418.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7387.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13096.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30428.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44355.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53315.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3049.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29843.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62474.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18245.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21386.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13616.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28109.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18885.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39949.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21488.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22282.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5491.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17136	dwm.exe
Token: SeChangeNotifyPrivilege	17136	dwm.exe
Token: 33	17136	dwm.exe
Token: SeIncBasePriorityPrivilege	17136	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
5100	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe
5076	Unicorn-11474.exe
468	Unicorn-47638.exe
4128	Unicorn-39173.exe
2960	Unicorn-45654.exe
448	Unicorn-40069.exe
3644	Unicorn-57823.exe
4984	Unicorn-52269.exe
3284	Unicorn-49695.exe
540	Unicorn-47583.exe
4696	Unicorn-14012.exe
1956	Unicorn-21059.exe
3528	Unicorn-39114.exe
3876	Unicorn-1459.exe
2364	Unicorn-27747.exe
2120	Unicorn-39114.exe
1480	Unicorn-61642.exe
2260	Unicorn-61629.exe
220	Unicorn-18070.exe
3024	Unicorn-11363.exe
4520	Unicorn-62221.exe
3968	Unicorn-26326.exe
800	Unicorn-13513.exe
4312	Unicorn-4583.exe
744	Unicorn-42931.exe
4140	Unicorn-20460.exe
1372	Unicorn-13513.exe
1944	Unicorn-26591.exe
2828	Unicorn-26591.exe
672	Unicorn-63793.exe
4384	Unicorn-43094.exe
2464	Unicorn-10675.exe
4632	Unicorn-28442.exe
4748	Unicorn-34573.exe
2876	Unicorn-5491.exe
336	Unicorn-40664.exe
2160	Unicorn-14814.exe
3872	Unicorn-1109.exe
4552	Unicorn-6869.exe
3248	Unicorn-39100.exe
2152	Unicorn-62614.exe
2812	Unicorn-29619.exe
4968	Unicorn-51286.exe
380	Unicorn-49764.exe
1428	Unicorn-4638.exe
4652	Unicorn-38733.exe
4684	Unicorn-30428.exe
1760	Unicorn-54358.exe
2348	Unicorn-40517.exe
4008	Unicorn-20892.exe
1524	Unicorn-2526.exe
4404	Unicorn-51649.exe
2560	Unicorn-58883.exe
4016	Unicorn-7081.exe
1032	Unicorn-51453.exe
1168	Unicorn-47135.exe
3288	Unicorn-22832.exe
3556	Unicorn-49631.exe
1476	Unicorn-27981.exe
4144	Unicorn-12080.exe
4300	Unicorn-26710.exe
4820	Unicorn-22691.exe
2004	Unicorn-2459.exe
3344	Unicorn-31946.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 5076	5100	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe	82
PID 5100 wrote to memory of 5076	5100	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe	82
PID 5100 wrote to memory of 5076	5100	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe	82
PID 5076 wrote to memory of 468	5076	Unicorn-11474.exe	87
PID 5076 wrote to memory of 468	5076	Unicorn-11474.exe	87
PID 5076 wrote to memory of 468	5076	Unicorn-11474.exe	87
PID 5100 wrote to memory of 4128	5100	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe	88
PID 5100 wrote to memory of 4128	5100	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe	88
PID 5100 wrote to memory of 4128	5100	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe	88
PID 468 wrote to memory of 2960	468	Unicorn-47638.exe	90
PID 468 wrote to memory of 2960	468	Unicorn-47638.exe	90
PID 468 wrote to memory of 2960	468	Unicorn-47638.exe	90
PID 5076 wrote to memory of 448	5076	Unicorn-11474.exe	91
PID 5076 wrote to memory of 448	5076	Unicorn-11474.exe	91
PID 5076 wrote to memory of 448	5076	Unicorn-11474.exe	91
PID 4128 wrote to memory of 3644	4128	Unicorn-39173.exe	92
PID 4128 wrote to memory of 3644	4128	Unicorn-39173.exe	92
PID 4128 wrote to memory of 3644	4128	Unicorn-39173.exe	92
PID 5100 wrote to memory of 4984	5100	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe	93
PID 5100 wrote to memory of 4984	5100	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe	93
PID 5100 wrote to memory of 4984	5100	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe	93
PID 2960 wrote to memory of 3284	2960	Unicorn-45654.exe	96
PID 2960 wrote to memory of 3284	2960	Unicorn-45654.exe	96
PID 2960 wrote to memory of 3284	2960	Unicorn-45654.exe	96
PID 448 wrote to memory of 540	448	Unicorn-40069.exe	97
PID 448 wrote to memory of 540	448	Unicorn-40069.exe	97
PID 448 wrote to memory of 540	448	Unicorn-40069.exe	97
PID 5076 wrote to memory of 2364	5076	Unicorn-11474.exe	98
PID 5076 wrote to memory of 2364	5076	Unicorn-11474.exe	98
PID 5076 wrote to memory of 2364	5076	Unicorn-11474.exe	98
PID 468 wrote to memory of 4696	468	Unicorn-47638.exe	99
PID 468 wrote to memory of 4696	468	Unicorn-47638.exe	99
PID 468 wrote to memory of 4696	468	Unicorn-47638.exe	99
PID 3644 wrote to memory of 3528	3644	Unicorn-57823.exe	100
PID 3644 wrote to memory of 3528	3644	Unicorn-57823.exe	100
PID 3644 wrote to memory of 3528	3644	Unicorn-57823.exe	100
PID 4984 wrote to memory of 2120	4984	Unicorn-52269.exe	101
PID 4984 wrote to memory of 2120	4984	Unicorn-52269.exe	101
PID 4984 wrote to memory of 2120	4984	Unicorn-52269.exe	101
PID 4128 wrote to memory of 3876	4128	Unicorn-39173.exe	102
PID 4128 wrote to memory of 3876	4128	Unicorn-39173.exe	102
PID 4128 wrote to memory of 3876	4128	Unicorn-39173.exe	102
PID 5100 wrote to memory of 1956	5100	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe	103
PID 5100 wrote to memory of 1956	5100	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe	103
PID 5100 wrote to memory of 1956	5100	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe	103
PID 3284 wrote to memory of 1480	3284	Unicorn-49695.exe	104
PID 3284 wrote to memory of 1480	3284	Unicorn-49695.exe	104
PID 3284 wrote to memory of 1480	3284	Unicorn-49695.exe	104
PID 2960 wrote to memory of 2260	2960	Unicorn-45654.exe	105
PID 2960 wrote to memory of 2260	2960	Unicorn-45654.exe	105
PID 2960 wrote to memory of 2260	2960	Unicorn-45654.exe	105
PID 4696 wrote to memory of 220	4696	Unicorn-14012.exe	106
PID 4696 wrote to memory of 220	4696	Unicorn-14012.exe	106
PID 4696 wrote to memory of 220	4696	Unicorn-14012.exe	106
PID 468 wrote to memory of 3024	468	Unicorn-47638.exe	107
PID 468 wrote to memory of 3024	468	Unicorn-47638.exe	107
PID 468 wrote to memory of 3024	468	Unicorn-47638.exe	107
PID 1956 wrote to memory of 4520	1956	Unicorn-21059.exe	108
PID 1956 wrote to memory of 4520	1956	Unicorn-21059.exe	108
PID 1956 wrote to memory of 4520	1956	Unicorn-21059.exe	108
PID 448 wrote to memory of 744	448	Unicorn-40069.exe	109
PID 448 wrote to memory of 744	448	Unicorn-40069.exe	109
PID 448 wrote to memory of 744	448	Unicorn-40069.exe	109
PID 5100 wrote to memory of 4312	5100	d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe	110

C:\Users\Admin\AppData\Local\Temp\d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe
"C:\Users\Admin\AppData\Local\Temp\d3084f6b3d0ae4d33467a762a55ce3ceb38dae41a8fd71b9b8f1d5688ae85d4cN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11474.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11474.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47638.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47638.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45654.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49695.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61642.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43094.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47135.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28426.exe
        9⤵
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8834.exe
        9⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21386.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58481.exe
        10⤵
        
        PID:12672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65438.exe
        10⤵
        
        PID:17316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30508.exe
        9⤵
        
        PID:8716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46550.exe
        9⤵
        
        PID:13064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19443.exe
        9⤵
        
        PID:16644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49920.exe
        8⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47946.exe
        9⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14006.exe
        9⤵
        
        PID:9972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12759.exe
        9⤵
        
        PID:13836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41401.exe
        9⤵
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37720.exe
        8⤵
        
        PID:7716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
        8⤵
        
        PID:10420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53105.exe
        8⤵
        
        PID:12644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42535.exe
        8⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22832.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56796.exe
        8⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21770.exe
        9⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31437.exe
        10⤵
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51078.exe
        10⤵
        
        PID:10956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47003.exe
        10⤵
        
        PID:14732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51602.exe
        10⤵
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33157.exe
        9⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43885.exe
        9⤵
        
        PID:10772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12681.exe
        9⤵
        
        PID:13872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8895.exe
        8⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54680.exe
        8⤵
        
        PID:10004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22186.exe
        8⤵
        
        PID:14296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54824.exe
        8⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42026.exe
        7⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13275.exe
        8⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59024.exe
        9⤵
        
        PID:11792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51587.exe
        9⤵
        
        PID:15584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31795.exe
        8⤵
        
        PID:9836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
        8⤵
        
        PID:13760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33546.exe
        8⤵
        
        PID:17076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41401.exe
        8⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8914.exe
        7⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42283.exe
        7⤵
        
        PID:10560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52611.exe
        7⤵
        
        PID:15792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10675.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49631.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31135.exe
        8⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10057.exe
        9⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18826.exe
        10⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60202.exe
        10⤵
        
        PID:13136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40714.exe
        10⤵
        
        PID:16504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50292.exe
        9⤵
        
        PID:8896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29779.exe
        9⤵
        
        PID:13640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54109.exe
        9⤵
        
        PID:16844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31749.exe
        8⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18.exe
        9⤵
        
        PID:15728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36891.exe
        8⤵
        
        PID:10116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18624.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45623.exe
        8⤵
        
        PID:17352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9733.exe
        7⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6335.exe
        8⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45083.exe
        8⤵
        
        PID:10528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61770.exe
        8⤵
        
        PID:13508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56450.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3049.exe
        7⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50948.exe
        7⤵
        
        PID:10536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53105.exe
        7⤵
        
        PID:12748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22691.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59249.exe
        7⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10014.exe
        8⤵
        
        PID:11128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43169.exe
        8⤵
        
        PID:16284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59486.exe
        7⤵
        
        PID:8328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48970.exe
        7⤵
        
        PID:12104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14902.exe
        7⤵
        
        PID:16084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50899.exe
        6⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-350.exe
        7⤵
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51.exe
        7⤵
        
        PID:9528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6816.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28437.exe
        7⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59179.exe
        6⤵
        
        PID:7812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40354.exe
        6⤵
        
        PID:10404
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10404 -s 464
        7⤵
        Program crash
        
        PID:14288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52876.exe
        6⤵
        
        PID:15240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61629.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34573.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33482.exe
        7⤵
        Executes dropped EXE
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29599.exe
        8⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55814.exe
        8⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25037.exe
        9⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22469.exe
        9⤵
        
        PID:9572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59416.exe
        9⤵
        
        PID:14352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16023.exe
        9⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41261.exe
        8⤵
        
        PID:8424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31425.exe
        8⤵
        
        PID:12348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37875.exe
        8⤵
        
        PID:16372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48352.exe
        8⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56000.exe
        7⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50442.exe
        8⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62474.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:15280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51784.exe
        9⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11047.exe
        8⤵
        
        PID:12812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39446.exe
        8⤵
        
        PID:14548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43467.exe
        8⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19110.exe
        7⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44228.exe
        7⤵
        
        PID:10876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5116.exe
        7⤵
        
        PID:14760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63188.exe
        7⤵
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12080.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29599.exe
        7⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23743.exe
        7⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-460.exe
        8⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48067.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20428.exe
        8⤵
        
        PID:16932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50503.exe
        7⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23920.exe
        7⤵
        
        PID:13156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17942.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4774.exe
        6⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51530.exe
        7⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61111.exe
        7⤵
        
        PID:9816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe
        7⤵
        
        PID:13660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57410.exe
        7⤵
        
        PID:1328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10054.exe
        6⤵
        
        PID:7428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47629.exe
        7⤵
        
        PID:10184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52724.exe
        7⤵
        
        PID:13892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13856.exe
        7⤵
        
        PID:11808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16599.exe
        7⤵
        
        PID:4816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60477.exe
        6⤵
        
        PID:10340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56090.exe
        6⤵
        
        PID:14864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58935.exe
        6⤵
        
        PID:7544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28442.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2459.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29599.exe
        7⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23743.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18826.exe
        8⤵
        
        PID:8588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28098.exe
        8⤵
        
        PID:12524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14630.exe
        8⤵
        
        PID:16024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61582.exe
        8⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50503.exe
        7⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16816.exe
        7⤵
        
        PID:11868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14032.exe
        7⤵
        
        PID:17376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50432.exe
        6⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16604.exe
        7⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51.exe
        7⤵
        
        PID:10100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6816.exe
        7⤵
        
        PID:14368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61979.exe
        6⤵
        
        PID:7932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2130.exe
        6⤵
        
        PID:10396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53882.exe
        6⤵
        
        PID:13512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38797.exe
        6⤵
        
        PID:8064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27981.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17674.exe
        6⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13851.exe
        7⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36827.exe
        7⤵
        
        PID:10088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15753.exe
        7⤵
        
        PID:14812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28987.exe
        7⤵
        
        PID:1204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28592.exe
        6⤵
        
        PID:7964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57695.exe
        7⤵
        
        PID:9672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58618.exe
        7⤵
        
        PID:14556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25729.exe
        6⤵
        
        PID:11716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55729.exe
        6⤵
        
        PID:15288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37802.exe
        6⤵
        
        PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61367.exe
        5⤵
        
        PID:644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26192.exe
        6⤵
        
        PID:9904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14073.exe
        6⤵
        
        PID:13776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20000.exe
        6⤵
        
        PID:17156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63579.exe
        6⤵
        
        PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42643.exe
        5⤵
        
        PID:7956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59532.exe
        5⤵
        
        PID:8568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17832.exe
        5⤵
        
        PID:14704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14012.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18070.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14814.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12044.exe
        7⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10328.exe
        8⤵
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13967.exe
        9⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22469.exe
        9⤵
        
        PID:11280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59416.exe
        9⤵
        
        PID:15380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28437.exe
        9⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46132.exe
        8⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59690.exe
        8⤵
        
        PID:11076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62547.exe
        8⤵
        
        PID:15168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59522.exe
        8⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40816.exe
        7⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-460.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48067.exe
        8⤵
        
        PID:11408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39178.exe
        8⤵
        
        PID:16880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42590.exe
        7⤵
        
        PID:8796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60200.exe
        7⤵
        
        PID:13620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1744.exe
        7⤵
        
        PID:16972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31424.exe
        7⤵
        
        PID:4648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        6⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54989.exe
        7⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44938.exe
        8⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22469.exe
        8⤵
        
        PID:11304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59416.exe
        8⤵
        
        PID:14452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41718.exe
        7⤵
        
        PID:8464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37334.exe
        7⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13616.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44763.exe
        6⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65418.exe
        7⤵
        
        PID:10156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58017.exe
        7⤵
        
        PID:13880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51602.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45895.exe
        6⤵
        
        PID:9452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63272.exe
        6⤵
        
        PID:13344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17561.exe
        6⤵
        
        PID:16396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39100.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63391.exe
        6⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5897.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62751.exe
        8⤵
        
        PID:10040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10690.exe
        8⤵
        
        PID:14028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27525.exe
        7⤵
        
        PID:8416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25559.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23568.exe
        7⤵
        
        PID:16100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30893.exe
        7⤵
        
        PID:17312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57862.exe
        6⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38413.exe
        7⤵
        
        PID:8456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60529.exe
        7⤵
        
        PID:14004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-538.exe
        7⤵
        
        PID:4100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52484.exe
        6⤵
        
        PID:10388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35545.exe
        6⤵
        
        PID:15780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1744.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7209.exe
        5⤵
        
        PID:4368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48217.exe
        6⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59743.exe
        7⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3699.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6816.exe
        7⤵
        
        PID:14356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44355.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43105.exe
        6⤵
        
        PID:11468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55617.exe
        6⤵
        
        PID:15864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43856.exe
        5⤵
        
        PID:7064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16508.exe
        5⤵
        
        PID:9472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46736.exe
        5⤵
        
        PID:13372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34627.exe
        5⤵
        
        PID:16416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11363.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1109.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12044.exe
        6⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37791.exe
        7⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28109.exe
        8⤵
        
        PID:7376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33424.exe
        9⤵
        
        PID:10448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42169.exe
        9⤵
        
        PID:12932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31787.exe
        9⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50871.exe
        8⤵
        
        PID:10568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6816.exe
        8⤵
        
        PID:14392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48244.exe
        7⤵
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-530.exe
        7⤵
        
        PID:13168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32048.exe
        7⤵
        
        PID:16592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46388.exe
        6⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53197.exe
        7⤵
        
        PID:9808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-386.exe
        7⤵
        
        PID:13676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45214.exe
        6⤵
        
        PID:9016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32586.exe
        6⤵
        
        PID:13228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65012.exe
        6⤵
        
        PID:17360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        5⤵
        
        PID:1504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47007.exe
        6⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49418.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29843.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57216.exe
        8⤵
        
        PID:16132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61111.exe
        7⤵
        
        PID:9928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe
        7⤵
        
        PID:13884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63965.exe
        7⤵
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55991.exe
        6⤵
        
        PID:7420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36205.exe
        6⤵
        
        PID:10144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65281.exe
        6⤵
        
        PID:14480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58111.exe
        6⤵
        
        PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64344.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7823.exe
        6⤵
        
        PID:6512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46839.exe
        6⤵
        
        PID:11372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12649.exe
        6⤵
        
        PID:14752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40539.exe
        6⤵
        
        PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3462.exe
        5⤵
        
        PID:8376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22759.exe
        5⤵
        
        PID:12300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18268.exe
        5⤵
        
        PID:1052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64495.exe
        5⤵
        
        PID:7976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6869.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10508.exe
        5⤵
        
        PID:1600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37791.exe
        6⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51487.exe
        7⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47629.exe
        8⤵
        
        PID:10172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58017.exe
        8⤵
        
        PID:13816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34581.exe
        8⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5302.exe
        7⤵
        
        PID:10512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49034.exe
        7⤵
        
        PID:16268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48244.exe
        6⤵
        
        PID:8008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47713.exe
        6⤵
        
        PID:12196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57363.exe
        6⤵
        
        PID:16180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46388.exe
        5⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11145.exe
        6⤵
        
        PID:8236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50563.exe
        6⤵
        
        PID:10712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        6⤵
        
        PID:15348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20332.exe
        5⤵
        
        PID:8872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35585.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19443.exe
        5⤵
        
        PID:16660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4409.exe
      4⤵
      PID:4980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48217.exe
        5⤵
        
        PID:5132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-460.exe
        6⤵
        
        PID:7832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45955.exe
        6⤵
        
        PID:11460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3994.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41142.exe
        5⤵
        
        PID:8512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43370.exe
        5⤵
        
        PID:12512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20495.exe
        5⤵
        
        PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53503.exe
        5⤵
        
        PID:5652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23891.exe
      4⤵
      PID:7080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46163.exe
        5⤵
        
        PID:10904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18245.exe
        5⤵
        
        PID:15496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16462.exe
      4⤵
      PID:9424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42271.exe
      4⤵
      PID:13364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38295.exe
      4⤵
      PID:16512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40069.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40069.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47583.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5491.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26710.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29599.exe
        7⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23743.exe
        7⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19231.exe
        8⤵
        
        PID:8268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7667.exe
        8⤵
        
        PID:11480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39178.exe
        8⤵
        
        PID:16888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9242.exe
        7⤵
        
        PID:8652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27606.exe
        7⤵
        
        PID:12836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2614.exe
        7⤵
        
        PID:16212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4897.exe
        7⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64256.exe
        6⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28109.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13808.exe
        7⤵
        
        PID:11012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6816.exe
        7⤵
        
        PID:14536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17303.exe
        6⤵
        
        PID:7824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-469.exe
        6⤵
        
        PID:11920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60986.exe
        6⤵
        
        PID:15656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49255.exe
        6⤵
        
        PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8026.exe
        5⤵
        Executes dropped EXE
        
        PID:612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29599.exe
        6⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55814.exe
        6⤵
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33424.exe
        7⤵
        
        PID:10440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42169.exe
        7⤵
        
        PID:14200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11694.exe
        7⤵
        
        PID:976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50503.exe
        6⤵
        
        PID:8644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23920.exe
        6⤵
        
        PID:13184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14032.exe
        6⤵
        
        PID:17388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43670.exe
        5⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4571.exe
        6⤵
        
        PID:7700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31347.exe
        6⤵
        
        PID:10584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55905.exe
        6⤵
        
        PID:13756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19657.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64430.exe
        6⤵
        
        PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39485.exe
        5⤵
        
        PID:7708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16869.exe
        5⤵
        
        PID:9468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4546.exe
        5⤵
        
        PID:14308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43548.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42931.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35248.exe
        5⤵
        
        PID:4972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
        6⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-460.exe
        7⤵
        
        PID:7996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45955.exe
        7⤵
        
        PID:11428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39178.exe
        7⤵
        
        PID:16860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37368.exe
        7⤵
        
        PID:16340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49399.exe
        6⤵
        
        PID:8384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37334.exe
        6⤵
        
        PID:12776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13616.exe
        6⤵
        
        PID:17192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22505.exe
        5⤵
        
        PID:6880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46163.exe
        6⤵
        
        PID:12128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18245.exe
        6⤵
        
        PID:15504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33693.exe
        6⤵
        
        PID:17084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36630.exe
        5⤵
        
        PID:10372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57146.exe
        5⤵
        
        PID:14844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7081.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36682.exe
        5⤵
        
        PID:1564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35929.exe
        6⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45276.exe
        7⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60202.exe
        7⤵
        
        PID:13120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28109.exe
        7⤵
        
        PID:16652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15802.exe
        7⤵
        
        PID:7556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18885.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43370.exe
        6⤵
        
        PID:12496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6790.exe
        6⤵
        
        PID:15264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44473.exe
        6⤵
        
        PID:1052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23295.exe
        5⤵
        
        PID:7132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3465.exe
        6⤵
        
        PID:10668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8179.exe
        6⤵
        
        PID:14616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60210.exe
        6⤵
        
        PID:16208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27741.exe
        5⤵
        
        PID:9860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21522.exe
        5⤵
        
        PID:13740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24880.exe
        5⤵
        
        PID:17128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47429.exe
        5⤵
        
        PID:6716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3407.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13851.exe
        5⤵
        
        PID:6640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11047.exe
        5⤵
        
        PID:12820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39446.exe
        5⤵
        
        PID:15228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12496.exe
        5⤵
        
        PID:5532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39528.exe
      4⤵
      PID:7876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25747.exe
      4⤵
      PID:10516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53635.exe
      4⤵
      PID:14144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40476.exe
      4⤵
      PID:5240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27747.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27747.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13513.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4638.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15000.exe
        6⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45834.exe
        7⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32848.exe
        8⤵
        
        PID:10612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42169.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59250.exe
        8⤵
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-182.exe
        7⤵
        
        PID:9264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8727.exe
        7⤵
        
        PID:14020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18936.exe
        7⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21872.exe
        6⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39434.exe
        7⤵
        
        PID:15952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43517.exe
        7⤵
        
        PID:7588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60205.exe
        6⤵
        
        PID:11168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15753.exe
        6⤵
        
        PID:14848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60482.exe
        6⤵
        
        PID:5528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11269.exe
        5⤵
        
        PID:5288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52554.exe
        6⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59740.exe
        7⤵
        
        PID:16136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11047.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39446.exe
        6⤵
        
        PID:14520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42328.exe
        5⤵
        
        PID:7868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59676.exe
        6⤵
        
        PID:11888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18245.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2151.exe
        6⤵
        
        PID:15340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50948.exe
        5⤵
        
        PID:10592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32613.exe
        5⤵
        
        PID:15812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40517.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20569.exe
        5⤵
        
        PID:4800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40667.exe
        6⤵
        
        PID:7204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30468.exe
        6⤵
        
        PID:9648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46763.exe
        6⤵
        
        PID:14312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29518.exe
        6⤵
        
        PID:6200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47473.exe
        5⤵
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29916.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25200.exe
        6⤵
        
        PID:14680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31787.exe
        6⤵
        
        PID:1236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4842.exe
        5⤵
        
        PID:11312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40080.exe
        5⤵
        
        PID:14808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21820.exe
        5⤵
        
        PID:7712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30551.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39964.exe
        5⤵
        
        PID:6624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47251.exe
        6⤵
        
        PID:10636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35830.exe
        6⤵
        
        PID:16924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9026.exe
        5⤵
        
        PID:8828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27530.exe
        5⤵
        
        PID:13956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39338.exe
        5⤵
        
        PID:6336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41537.exe
      4⤵
      PID:7112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39434.exe
        5⤵
        
        PID:15960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11117.exe
      4⤵
      PID:9396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54929.exe
      4⤵
      PID:14012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9474.exe
      4⤵
      PID:1896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30390.exe
      4⤵
      PID:6472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26326.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26326.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32176.exe
      4⤵
      PID:1924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47473.exe
        5⤵
        
        PID:6904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14622.exe
        6⤵
        
        PID:10792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25200.exe
        6⤵
        
        PID:14664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60210.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26781.exe
        5⤵
        
        PID:9708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64257.exe
        5⤵
        
        PID:13584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62519.exe
        5⤵
        
        PID:16948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61208.exe
      4⤵
      PID:6920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3090.exe
        5⤵
        
        PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24897.exe
        5⤵
        
        PID:536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43819.exe
      4⤵
      PID:10408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36569.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9424.exe
      4⤵
      PID:3144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51453.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51453.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38218.exe
      4⤵
      PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25628.exe
        5⤵
        
        PID:5588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-460.exe
        6⤵
        
        PID:8436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15984.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34848.exe
        6⤵
        
        PID:16528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38070.exe
        5⤵
        
        PID:8748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6167.exe
        5⤵
        
        PID:12992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49930.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34369.exe
        5⤵
        
        PID:4388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32934.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32934.exe
      4⤵
      PID:7380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60252.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23868.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2151.exe
        5⤵
        
        PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32584.exe
        5⤵
        
        PID:7576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-597.exe
      4⤵
      PID:9584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18428.exe
      4⤵
      PID:14172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55444.exe
      4⤵
      PID:5044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16421.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16421.exe
    3⤵
    PID:5140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35533.exe
      4⤵
      PID:6496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14622.exe
        5⤵
        
        PID:10964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33267.exe
        5⤵
        
        PID:14744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10734.exe
        5⤵
        
        PID:3988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1858.exe
      4⤵
      PID:10020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30852.exe
      4⤵
      PID:14332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40058.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40058.exe
    3⤵
    PID:7892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14562.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14562.exe
    3⤵
    PID:10888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9800.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9800.exe
    3⤵
    PID:14656
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39173.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39173.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57823.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57823.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39114.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35248.exe
        6⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31027.exe
        7⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
        8⤵
        
        PID:11984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11312.exe
        8⤵
        
        PID:16164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4842.exe
        7⤵
        
        PID:11296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40080.exe
        7⤵
        
        PID:14436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4941.exe
        7⤵
        
        PID:1280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61208.exe
        6⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51213.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8179.exe
        7⤵
        
        PID:14636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46313.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25174.exe
        6⤵
        
        PID:9520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61736.exe
        6⤵
        
        PID:13484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39958.exe
        6⤵
        
        PID:16588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57940.exe
        6⤵
        
        PID:14576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20117.exe
        5⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10057.exe
        6⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31251.exe
        7⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25920.exe
        7⤵
        
        PID:14520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14006.exe
        6⤵
        
        PID:9872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
        6⤵
        
        PID:13748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33546.exe
        6⤵
        
        PID:17084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64888.exe
        6⤵
        
        PID:1052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42685.exe
        5⤵
        
        PID:7072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54730.exe
        6⤵
        
        PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17555.exe
        5⤵
        
        PID:10044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10489.exe
        5⤵
        
        PID:13804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15065.exe
        5⤵
        
        PID:17340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40664.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31946.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20383.exe
        6⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11788.exe
        7⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45306.exe
        7⤵
        
        PID:11840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65322.exe
        7⤵
        
        PID:15604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4605.exe
        7⤵
        
        PID:7180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6707.exe
        6⤵
        
        PID:7840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9754.exe
        6⤵
        
        PID:11088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12681.exe
        6⤵
        
        PID:13392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15792.exe
        5⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19231.exe
        6⤵
        
        PID:8292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26873.exe
        6⤵
        
        PID:11676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3994.exe
        6⤵
        
        PID:15204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45523.exe
        5⤵
        
        PID:8832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26919.exe
        5⤵
        
        PID:13204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15513.exe
        5⤵
        
        PID:16572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13891.exe
      4⤵
      PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20173.exe
        5⤵
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13851.exe
        6⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1883.exe
        7⤵
        
        PID:16000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65147.exe
        7⤵
        
        PID:7288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11047.exe
        6⤵
        
        PID:12804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39446.exe
        6⤵
        
        PID:13544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29518.exe
        6⤵
        
        PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28592.exe
        5⤵
        
        PID:7916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25729.exe
        5⤵
        
        PID:11724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55729.exe
        5⤵
        
        PID:15196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15975.exe
      4⤵
      PID:2580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45276.exe
        5⤵
        
        PID:7900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60202.exe
        5⤵
        
        PID:13128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40714.exe
        5⤵
        
        PID:16496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20347.exe
        5⤵
        
        PID:1644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42643.exe
      4⤵
      PID:7668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57420.exe
      4⤵
      PID:11028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32881.exe
      4⤵
      PID:16344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19464.exe
      4⤵
      PID:5236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1459.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1459.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13513.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20892.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38218.exe
        6⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8606.exe
        7⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47629.exe
        8⤵
        
        PID:9288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60529.exe
        8⤵
        
        PID:14044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11744.exe
        8⤵
        
        PID:16220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15063.exe
        8⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38070.exe
        7⤵
        
        PID:8740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40685.exe
        7⤵
        
        PID:13092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28109.exe
        7⤵
        
        PID:16632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32934.exe
        6⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37389.exe
        7⤵
        
        PID:10900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        7⤵
        
        PID:15188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-597.exe
        6⤵
        
        PID:9576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18428.exe
        6⤵
        
        PID:14180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44043.exe
        6⤵
        
        PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42239.exe
        5⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-350.exe
        6⤵
        
        PID:6476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48375.exe
        6⤵
        
        PID:10436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6816.exe
        6⤵
        
        PID:5072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43035.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43821.exe
        5⤵
        
        PID:7624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29916.exe
        6⤵
        
        PID:10748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25200.exe
        6⤵
        
        PID:14688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44201.exe
        6⤵
        
        PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33409.exe
        5⤵
        
        PID:10688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4016.exe
        5⤵
        
        PID:15356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51117.exe
      4⤵
      PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10328.exe
        5⤵
        
        PID:6132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5851.exe
        6⤵
        
        PID:7440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37046.exe
        6⤵
        
        PID:11680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52696.exe
        6⤵
        
        PID:14792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48244.exe
        5⤵
        
        PID:7540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62995.exe
        5⤵
        
        PID:13012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41265.exe
        5⤵
        
        PID:1648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60417.exe
      4⤵
      PID:6240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12339.exe
        5⤵
        
        PID:10696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9888.exe
        5⤵
        
        PID:14876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-538.exe
        5⤵
        
        PID:5696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10407.exe
      4⤵
      PID:8816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10384.exe
      4⤵
      PID:13196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32579.exe
      4⤵
      PID:16516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20460.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20460.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2526.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38218.exe
        5⤵
        
        PID:1276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21020.exe
        6⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1932.exe
        7⤵
        
        PID:13276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2681.exe
        7⤵
        
        PID:17184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16773.exe
        6⤵
        
        PID:8708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40685.exe
        6⤵
        
        PID:13044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40714.exe
        6⤵
        
        PID:16552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24255.exe
        5⤵
        
        PID:7052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60252.exe
        6⤵
        
        PID:12152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18245.exe
        6⤵
        
        PID:4996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8622.exe
        6⤵
        
        PID:5980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31187.exe
        5⤵
        
        PID:10364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32613.exe
        5⤵
        
        PID:15804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1456.exe
      4⤵
      PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58573.exe
        5⤵
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12339.exe
        6⤵
        
        PID:10720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9888.exe
        6⤵
        
        PID:14900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-538.exe
        6⤵
        
        PID:748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47000.exe
        5⤵
        
        PID:9912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37395.exe
        5⤵
        
        PID:11992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56936.exe
        5⤵
        
        PID:4356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13414.exe
      4⤵
      PID:7104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47364.exe
      4⤵
      PID:10192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63659.exe
      4⤵
      PID:13912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57190.exe
      4⤵
      PID:15076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57940.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51649.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51649.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41090.exe
      4⤵
      PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7387.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21488.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6816.exe
        5⤵
        
        PID:13784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61979.exe
      4⤵
      PID:7128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1554.exe
      4⤵
      PID:12156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48698.exe
      4⤵
      PID:16112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11452.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11452.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56223.exe
      4⤵
      PID:7228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4553.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1693.exe
        5⤵
        
        PID:7836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21043.exe
      4⤵
      PID:9464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6615.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43513.exe
      4⤵
      PID:1356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22053.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22053.exe
    3⤵
    PID:8056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1614.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1614.exe
    3⤵
    PID:11016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1137.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1137.exe
    3⤵
    PID:14796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53387.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53387.exe
    3⤵
    PID:3256
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52269.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52269.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39114.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39114.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54358.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14424.exe
        6⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22943.exe
        7⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20560.exe
        8⤵
        
        PID:9408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61690.exe
        8⤵
        
        PID:14884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21611.exe
        8⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30323.exe
        7⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46954.exe
        7⤵
        
        PID:12936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22282.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21936.exe
        6⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51213.exe
        7⤵
        
        PID:10640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40097.exe
        7⤵
        
        PID:16016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27477.exe
        7⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8249.exe
        6⤵
        
        PID:11876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45986.exe
        6⤵
        
        PID:15624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17538.exe
        5⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30873.exe
        6⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57055.exe
        7⤵
        
        PID:11976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11312.exe
        7⤵
        
        PID:16188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14006.exe
        6⤵
        
        PID:9880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30852.exe
        6⤵
        
        PID:13704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38119.exe
        6⤵
        
        PID:7604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3049.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50948.exe
        5⤵
        
        PID:10576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35545.exe
        5⤵
        
        PID:15772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58883.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31498.exe
        5⤵
        
        PID:1528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-329.exe
        6⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50908.exe
        7⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13984.exe
        7⤵
        
        PID:14268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57410.exe
        7⤵
        
        PID:16088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61044.exe
        6⤵
        
        PID:8636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21740.exe
        6⤵
        
        PID:12872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64647.exe
        6⤵
        
        PID:15272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48049.exe
        5⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29916.exe
        6⤵
        
        PID:10700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42169.exe
        6⤵
        
        PID:13732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33693.exe
        6⤵
        
        PID:2700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19308.exe
        5⤵
        
        PID:9536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4864.exe
        5⤵
        
        PID:13476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56936.exe
        5⤵
        
        PID:3640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63079.exe
      4⤵
      PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52554.exe
        5⤵
        
        PID:6936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-322.exe
        6⤵
        
        PID:9480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6615.exe
        6⤵
        
        PID:14096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7934.exe
        6⤵
        
        PID:3984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23155.exe
        5⤵
        
        PID:10124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30852.exe
        5⤵
        
        PID:13632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35256.exe
        5⤵
        
        PID:5700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48193.exe
      4⤵
      PID:7848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19365.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19365.exe
      4⤵
      PID:11400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49466.exe
      4⤵
      PID:14488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63793.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63793.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38733.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65052.exe
        5⤵
        
        PID:1064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4059.exe
        6⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38684.exe
        7⤵
        
        PID:13232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51703.exe
        7⤵
        
        PID:436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49606.exe
        6⤵
        
        PID:10060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30852.exe
        6⤵
        
        PID:13736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4411.exe
        6⤵
        
        PID:6148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18800.exe
        5⤵
        
        PID:8016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64813.exe
        5⤵
        
        PID:10936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44801.exe
        5⤵
        
        PID:14644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42937.exe
        5⤵
        
        PID:4856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34559.exe
      4⤵
      PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11593.exe
        5⤵
        
        PID:6788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32848.exe
        6⤵
        
        PID:10496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42169.exe
        6⤵
        
        PID:13712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4592.exe
        5⤵
        
        PID:6420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6679.exe
        5⤵
        
        PID:12164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5766.exe
        5⤵
        
        PID:17344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6185.exe
      4⤵
      PID:6812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42756.exe
      4⤵
      PID:10228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31801.exe
      4⤵
      PID:13972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57946.exe
      4⤵
      PID:4660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49764.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49764.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7195.exe
      4⤵
      PID:1068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49180.exe
        5⤵
        
        PID:6524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27728.exe
        6⤵
        
        PID:9380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60529.exe
        6⤵
        
        PID:14060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51602.exe
        6⤵
        
        PID:624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21174.exe
        5⤵
        
        PID:9020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29719.exe
        5⤵
        
        PID:13244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40714.exe
        5⤵
        
        PID:16536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31152.exe
      4⤵
      PID:6780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63882.exe
        5⤵
        
        PID:8724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58417.exe
        5⤵
        
        PID:14108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33045.exe
        5⤵
        
        PID:3296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15593.exe
      4⤵
      PID:10236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14592.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47429.exe
      4⤵
      PID:16992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31684.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31684.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5897.exe
      4⤵
      PID:5864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45276.exe
        5⤵
        
        PID:8204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60202.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28109.exe
        5⤵
        
        PID:16676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27525.exe
      4⤵
      PID:8860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29779.exe
      4⤵
      PID:13648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54109.exe
      4⤵
      PID:16984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21837.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58408.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58408.exe
    3⤵
    PID:6928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14622.exe
      4⤵
      PID:10784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25200.exe
      4⤵
      PID:14696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44201.exe
      4⤵
      PID:116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65510.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65510.exe
    3⤵
    PID:9488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9666.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9666.exe
    3⤵
    PID:13404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13096.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13096.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:15232
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21059.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21059.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62221.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62221.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62614.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14299.exe
        5⤵
        
        PID:2080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20173.exe
        6⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50442.exe
        7⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65418.exe
        8⤵
        
        PID:9372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60529.exe
        8⤵
        
        PID:14052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50066.exe
        8⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11047.exe
        7⤵
        
        PID:12788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39446.exe
        7⤵
        
        PID:16360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41994.exe
        7⤵
        
        PID:7044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5375.exe
        6⤵
        
        PID:7944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25729.exe
        6⤵
        
        PID:11732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55729.exe
        6⤵
        
        PID:15212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50609.exe
        5⤵
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18826.exe
        6⤵
        
        PID:8212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60202.exe
        6⤵
        
        PID:13112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28109.exe
        6⤵
        
        PID:16668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7130.exe
        5⤵
        
        PID:8492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28668.exe
        5⤵
        
        PID:12780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59665.exe
        5⤵
        
        PID:17020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45754.exe
        5⤵
        
        PID:7244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
      4⤵
      PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23967.exe
        5⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44121.exe
        6⤵
        
        PID:9772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-386.exe
        6⤵
        
        PID:13668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43934.exe
        6⤵
        
        PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58932.exe
        5⤵
        
        PID:8484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37334.exe
        5⤵
        
        PID:12952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13616.exe
        5⤵
        
        PID:17172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5463.exe
      4⤵
      PID:6772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33674.exe
        5⤵
        
        PID:9620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22551.exe
        5⤵
        
        PID:15596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20347.exe
        5⤵
        
        PID:16768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24193.exe
      4⤵
      PID:9248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3879.exe
      4⤵
      PID:10400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46102.exe
      4⤵
      PID:17332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29619.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29619.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34969.exe
      4⤵
      PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37791.exe
        5⤵
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58762.exe
        6⤵
        
        PID:8892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9913.exe
        6⤵
        
        PID:13108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16416.exe
        6⤵
        
        PID:17100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48244.exe
        5⤵
        
        PID:7808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61226.exe
        5⤵
        
        PID:12176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57363.exe
        5⤵
        
        PID:16172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46388.exe
      4⤵
      PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39949.exe
        5⤵
        
        PID:9628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14496.exe
        5⤵
        
        PID:14988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15063.exe
        5⤵
        
        PID:5260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37915.exe
      4⤵
      PID:8444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25482.exe
      4⤵
      PID:11916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34477.exe
      4⤵
      PID:17204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26726.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26726.exe
    3⤵
    PID:920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24906.exe
      4⤵
      PID:3444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50442.exe
        5⤵
        
        PID:6896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39949.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35827.exe
        6⤵
        
        PID:14320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52178.exe
        6⤵
        
        PID:5224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16914.exe
        5⤵
        
        PID:11896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        5⤵
        
        PID:15616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53315.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38363.exe
      4⤵
      PID:10908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13781.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46585.exe
      4⤵
      PID:5768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60417.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60417.exe
    3⤵
    PID:6260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18826.exe
      4⤵
      PID:8580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29634.exe
      4⤵
      PID:12540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28823.exe
      4⤵
      PID:16144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28996.exe
      4⤵
      PID:7648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39790.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39790.exe
    3⤵
    PID:8788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60730.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60730.exe
    3⤵
    PID:13612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62816.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62816.exe
    3⤵
    PID:17004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4558.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4558.exe
    3⤵
    PID:3020
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4583.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4583.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51286.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51286.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32857.exe
      4⤵
      PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53401.exe
        5⤵
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25037.exe
        6⤵
        
        PID:8024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32028.exe
        7⤵
        
        PID:15176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21888.exe
        7⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47402.exe
        6⤵
        
        PID:11848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
        6⤵
        
        PID:1888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64888.exe
        6⤵
        
        PID:2796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27525.exe
        5⤵
        
        PID:8404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37334.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13616.exe
        5⤵
        
        PID:17148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29439.exe
      4⤵
      PID:7096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12126.exe
        5⤵
        
        PID:10628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38137.exe
        5⤵
        
        PID:14540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31787.exe
        5⤵
        
        PID:6192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18732.exe
      4⤵
      PID:9432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18761.exe
      4⤵
      PID:13272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64055.exe
      4⤵
      PID:16088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30049.exe
      4⤵
      PID:564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52867.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52867.exe
    3⤵
    PID:5040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32732.exe
      4⤵
      PID:5688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-460.exe
        5⤵
        
        PID:8360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43458.exe
        5⤵
        
        PID:11380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17702.exe
        5⤵
        
        PID:16120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51602.exe
        5⤵
        
        PID:17092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50935.exe
      4⤵
      PID:8344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57194.exe
      4⤵
      PID:12084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23568.exe
      4⤵
      PID:16152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40441.exe
      4⤵
      PID:5836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24275.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24275.exe
    3⤵
    PID:7184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32848.exe
      4⤵
      PID:10488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42169.exe
      4⤵
      PID:13788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45737.exe
      4⤵
      PID:3728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14765.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14765.exe
    3⤵
    PID:9556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-793.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-793.exe
    3⤵
    PID:14072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38521.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38521.exe
    3⤵
    PID:5988
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30428.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30428.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61404.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61404.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-88.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-88.exe
      4⤵
      PID:6500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47626.exe
        5⤵
        
        PID:11996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11312.exe
        5⤵
        
        PID:16104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65414.exe
      4⤵
      PID:9000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29719.exe
      4⤵
      PID:13236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40714.exe
      4⤵
      PID:16580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exe
    3⤵
    PID:6712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23775.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53120.exe
      4⤵
      PID:15748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42692.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42692.exe
    3⤵
    PID:10076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7088.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7088.exe
    3⤵
    PID:14828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2401.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2401.exe
    3⤵
    PID:6068
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33487.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33487.exe
  2⤵
  PID:5148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19359.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19359.exe
    3⤵
    PID:6012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9179.exe
      4⤵
      PID:7756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19476.exe
        5⤵
        
        PID:2036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38701.exe
      4⤵
      PID:11392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18514.exe
      4⤵
      PID:14552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2675.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2675.exe
    3⤵
    PID:7728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36205.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36205.exe
    3⤵
    PID:11288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58161.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58161.exe
    3⤵
    PID:15740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28688.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28688.exe
    3⤵
    PID:1620
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30751.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30751.exe
  2⤵
  PID:6268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51487.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51487.exe
    3⤵
    PID:7196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61556.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61556.exe
    3⤵
    PID:10948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6816.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6816.exe
    3⤵
    PID:1700
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4040.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4040.exe
  2⤵
  PID:8448
- C:\Users\Admin\AppData\Local\Temp\Unicorn-624.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-624.exe
  2⤵
  PID:12292
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50469.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50469.exe
  2⤵
  PID:14860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 10404 -ip 10404
1⤵
PID:12100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 17128 -ip 17128
1⤵
PID:1656

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10675.exe

Filesize
468KB

MD5
d791b23c0330dccc58ff210e46eaa309

SHA1
5160b9bebb881cfffd1342fa8b6d34df032f9b9e

SHA256
158e62fc8e463033db3354144e4ecf623f89fb078dc14aacfc79274cff807cea

SHA512
8327f54bc6441db9272ff9756bc777ca3ef05f61b4592d591f167262fd7b5788afbe792768398720161944890ca271e7380bb8b986862e508bf9b8f46c954d28

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11363.exe

Filesize
468KB

MD5
ca59ebd4ad2055676ff89059b3268c0d

SHA1
759242ae798e7bb0c566d3fe4e8171b8507c96ff

SHA256
61b7deb47aca3887a55a59503cdd2be02ac966c63a49ed20cb2808885ff1252e

SHA512
dee535bdf070ed99781ccf7c9b6e1d9c835827c4cf3ebfb40b36de3a5f55f88746da38c0e633a18f3e44d6133fa2390d65f1518bbd4452508148be4f45e6de56

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11474.exe

Filesize
468KB

MD5
01bc131e53d1cf882a99983a0c0c9f81

SHA1
726c6511bda31dcde1ec920136f0d69804fa48f6

SHA256
3b37ac77a3f48920ca301602a5dde726d71b5afc7c7d4998460437f9aa9d1703

SHA512
7095c3863a7b55ef5f37bd0042964ea471d8863142ef563f2149f451a4f3683cc4b2cf8134502a89e3e89c3bada3b41e9708c7d4dff202558bc2f95c4f16ee54

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13513.exe

Filesize
468KB

MD5
72051dcf230acac6d7125238262bcca2

SHA1
dea62951ac6dc0b55a66e222a9ca8fdb4627e800

SHA256
ce6cc6c160b42ff833d8c88e8eea7e5b0dd108d3a6143fd5ef1c0feb39dccfa2

SHA512
20b85d8b7aec80109bfcefb887ca8e1f649e2fd184a252c27080b6cc5fcdb8ff25e9ebb6b636539695d03532842595ff25614471952a41a7f7ad1acc2ae306b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14012.exe

Filesize
468KB

MD5
2bd9a72710b1a26f487fa68a0e17c75c

SHA1
2978af9707dd477e914052dc52ab7dd6178d2897

SHA256
8cf0c582ae03eadb8f1b86e1e9cea48f791dd31b708ea96476715c07b4934e2a

SHA512
3b66427d8a8978b3dc626bc4ba53ce3342adbf668c6be83d14a79ba94f5ff4ad901c5f2290c33f49211c9dc4c5918276fbaff0931c9ebbcdd8391cc42f30f633

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1459.exe

Filesize
468KB

MD5
8f75ab38203a0e3ff3b207606f7840f7

SHA1
5eb0b40c7219cae54c3b8cc984dc52c76c5e2f98

SHA256
3b131566862365f429883b0923829cd2bc7a9c4714229d564461fcc1d4d9cd4b

SHA512
b75f44b08a3621f8eaa34efb965d19496d01b05cef350f9d1d087e39176d89d078b59161e2cd936ac9a104b383c57f8cd37e695ae2e1d04c749c09033c1d6f4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18070.exe

Filesize
468KB

MD5
a35901e87d415733e768601f0bb556da

SHA1
0c82fa0c020c119f6b37fd420d690f0ed43dbf7d

SHA256
d551345ade0e67174bc4aceb23bbdb2f6a3635aeabd54c67803aa214e89af1e1

SHA512
3609cc00d974c9fb319fcb6b315d18eda9bf4f6bc0084f3613c6004b7466f72d9dea12ef8b60ee9b447d43ec559c5fb2803e56020466cd1176505f995fb1df3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20460.exe

Filesize
468KB

MD5
db1c4048e61799fedb8d85a51d42fa90

SHA1
3780a086a689e45ed734044c176f521eb696a994

SHA256
6724722166513d36313821d00d06b4a565a2ad7bc0fa878d8dc8ee744ae65b54

SHA512
1add49ee7c864ad205d9a5600699e998b84f7de606775bd763ebec169688d48e8cb47862d3df8fa9fb2d3aca6ab432003a61c6f8cc7ceeb14fa54902a68302b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21059.exe

Filesize
468KB

MD5
03488d2e8c20e491e8e8c8c621205f33

SHA1
49b6f0f2637a9a04ed54be03ba59693b1b34d689

SHA256
f3055d0a98e7f2b1f53632ef8acca14fbeaa24e2e198b1a00fef48bf681c12e5

SHA512
2b9ed77504c9d02212fb05362163ee87d88e1c87cdfaac61ae745afa2619d139d8e2a135ba3ad950c4bf8d3669a4199863931e392c613e54651f30d839d9755d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26326.exe

Filesize
468KB

MD5
383157018b3140c74a746c4e018011b9

SHA1
4b8d7543237c0ec03cb6335a002263574b492bb2

SHA256
1098a7b67e5e6491b23423c80419ccae2df860b4776cfdec067f5f8b9986490a

SHA512
59baa2e9f96250e2e0d1f89260320e8392b329a4b68cd5176b8024a35488c1a118a40c2a08182a11f70b748710539dfb329105c8996679eafc4da341abafa930

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe

Filesize
468KB

MD5
e32229c5d9fb6ba7801d9865203c7c1a

SHA1
d7995456fac38408df809c87901a02ff1e6be129

SHA256
26647e6968908a445f69b535a9b1bb3f34994cefd6e71cc52d444aa85ad90ca3

SHA512
742b53409ea1765571bddf22088cb4ab8bdf52c4d6ca33b4b0e39d53c783a0c032c04925452a8df2a20d45e641ca99a5554e8550063f94caa1d6613ba9604e13

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27747.exe

Filesize
468KB

MD5
e2bca8ce5e1a0f3fe1b68f0782414bc4

SHA1
3402896851f28024e8748dcf4ae050c683003c14

SHA256
3b915d3f19c174e3a2aef90a088a9f7db9cf12c2898cc50d242a573c47428c32

SHA512
d2b8820cf9c876fe0c33bb83e1efd52954ea70fe284db3d715513c5e968c879d338ca13a9fe462f86e648878647e5762ce62ca6bf3ae43d310fd2800803884a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28442.exe

Filesize
468KB

MD5
f87ba2b5e45813e380329106ad2b5f2c

SHA1
0af97e306b7b2dc71cfec06b5f9d6fea62c6ab43

SHA256
c2fcb17d648a0d49cb879b0407abe6182ec6c8dbbcd448c02b72c0b5c4c31836

SHA512
7167fe64380fe9fc37bf16aba23eddbaadc11d07ea1779a43d4a70c6ef22fe31c5af3dcee1f2078b432ce078432e1f769d19804d4b2a70045f9dc2c8882ad11f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34573.exe

Filesize
468KB

MD5
7c009d5aa1302b23167979cdee0902a7

SHA1
d8a4b7279bf64bb60269333d57b1da189e027f9c

SHA256
e271333b971db0f9c4477a8b81eb48d4b06dd7fded3c3c2275a84100559fe5e4

SHA512
a844d62448393f092ac0b4b7a131b144bbf975dc59552bb5c31c95ff2b97ef3e9ef9003500818a0c8c28c0199eccf7165aad4a60b97b44add02b7f91e9e430b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39114.exe

Filesize
468KB

MD5
df94975b875c02403a29c5d8981ea765

SHA1
dd01548e203da6d553033b63df1e93d3b673fbb7

SHA256
aebaef5ca510807ba7c1ae423363b1c58e6c2fac68ed62608a2ccba00fc46a4e

SHA512
cbedbddf6f8e190ffcf1a09c50d8bcf4a8397e446707fefc7e6277ab1c0a4df71b896e34d77145cf02df87cbbfacfc84d9b448a3f11f36733cfeb4db2d0fc564

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39173.exe

Filesize
468KB

MD5
b97cb645b09ef5280c816acf2a533d5b

SHA1
96646db2f0fc5f99f0dd32c897bdb502ff786a0d

SHA256
ef5e481501300424737f1decc318042336d099c0e1a5d8a57c582c1d9684e3a2

SHA512
9ed19cba900fa62ce240a261647f91398776d9af58704f4f134c446bc0bba09af032eca4a533d71c14171bd4397e307d6a30a765e6eecc6c9223d064389a2aa3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40069.exe

Filesize
468KB

MD5
c27c2a5f33d370b452e2eaa2a00f652e

SHA1
55138d144058ee5e51f49b355015fee9ac08e0c1

SHA256
7b018ad3ebe2a041952ab650fc79ac06b3c4108ede94a91295725e6a7b525897

SHA512
77328b34bdda6e1984b73b2cf8f3fad9a751b318820b46f4d3de0feccfc54b18e44795a18fedee2f8d6a5e9e7bbeebae50dd5338e514c3f4364e6d7123b8bb4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42931.exe

Filesize
468KB

MD5
42b5dcdcb1ea0312750d441d5344f272

SHA1
2653a471531bf92b019e7b850b20765e3e6a2496

SHA256
094a823eedb95dbd29cc39dd665c1b91860820e403f65a018e6d0042512a2d43

SHA512
119dc1c0a1a8a8a4f71765e81068c2533b7ef3590211e6c02a45afff4708307933ed081b471f6df0b0aadb6d5eccf2540986ae761e379869b0dc4e7835a00969

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43094.exe

Filesize
468KB

MD5
9d7c10ac8c6634b67ea09ab07cf028de

SHA1
cd6e96881dfef5186c0c314035a4bed8b26342c8

SHA256
4b6ac1a64a5247401ca3d427938e73afec27fbf3f9dde7b70a94f9b65a174e01

SHA512
6d274eafe591b691e13773cb9f3745fe901fc0dea80c91c963119fc4a0f7786be7c97d5b19a30aab946a2fb5559d1699940951aad6086c255abdd4396e4bf88a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45654.exe

Filesize
468KB

MD5
56bc6bc7d405222e7d528c2b5dd23828

SHA1
98c720b77318eef9fad657e538dea0c814a48059

SHA256
96031f92b639dc02a697dcdd92022ade7be28de5cc2521a34e7d0379e1cef11a

SHA512
2e179f751670e2623073dc8906fe47512737745247506b1ea9e6d36cc65f6aff7b5acac3f61b77fedd52492c1dd530dfbd49ebb68ad6e6f2c0ed23e64aba9616

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4583.exe

Filesize
468KB

MD5
c2bad6fe3cdf9c93bf7df01393551a28

SHA1
adbe0823e447d43af202021312ce7bbb1f62cdef

SHA256
95f676dee51447a0e56a958444acfd746a7440f3b4890a160fffc84b554c7c98

SHA512
901326c02f69d3272cb0dfca9f0ec00f2853e1727b7bebcba14b78dad934b920879ccf7402f8d8f378a322dfea03165a15a4cdce020807855b15e543758b8eb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45955.exe

Filesize
468KB

MD5
217d714738958410c549491f59b667cf

SHA1
1acefdefd431869766e9239cc876c9480ebeb6d6

SHA256
f2501a4d5b768f92acd084af40ad2d97f2d084b05cd7c8e4d7d0f46d9b751dec

SHA512
d4bbabfd60b553af86502d6ca9b6b79d8d203305bf502c838691aa3fc2923ca3ea4c9e583d82d58dcbf9f0730085f6a9017cccb60edd80cf50d61fbff5f7a806

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47583.exe

Filesize
468KB

MD5
c3c862154c597dd4a0a04fcdebf90910

SHA1
36b7d5bd1a2edcc8b706e5ddfd10f27a68de4dd3

SHA256
d52b046b15e689960733b740d05ab08c08b504c61579ad7ca1fbac494b144038

SHA512
d37e30ad6e8bb70d563c57b1f73b8d78b13163e272449b87477f06d88e1e4e4422f94e737d48ddac0d20ac3288d38694a16e16df07efbe7ff01d2bdce758a054

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47638.exe

Filesize
468KB

MD5
bb2b1820f0aefdc470b65a08e65efaee

SHA1
429694978a2e7077bd46eeb682a7b5fe0b745c03

SHA256
f25b4787e77c4b09cda730657d9c941810beaf765332e1502879ea1930601f1f

SHA512
4131c3f0b23d41916b5a00d25397adbad08461e8617522b7cceeaef1fc773abe1ed880f0f3aaaccc53cfea2aa4f6c82d3871afee9a9aa13231ae245ccf342549

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49695.exe

Filesize
468KB

MD5
d7dc1729c74f8823851bc2c67c2ea3b8

SHA1
f9116bceeb6c0cc2a447aa19c8e482e587952cc9

SHA256
705c9f79b0909eca940b12fe81703f4bd57cba96c50e554d23a6456d9b51994c

SHA512
3542fd1aa939f959e79cd82e35d2084fc0dda187f7b0a0710dfbfb35f4537a2fc55d300a89e255450d907a7971e246f9d79263598750c97cd9fc56e824493062

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52269.exe

Filesize
468KB

MD5
5bdaad970ac941b5dc34523b887e4e32

SHA1
29bbbe3844958666bb7ed2c216a6925c71184a2b

SHA256
3b7676afdb6e979bda38f00c05e513f4bfaf50fe203db918f96f0e07fffee8f9

SHA512
d681c62dc68cdaee928a55a102728cd44572f74f96e4df017036c7bd84e1b93a88909073a5f24b1493723ac1ef3f5391e9651d5bcbad8741c8ef7c3d51a6dfd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57823.exe

Filesize
468KB

MD5
2592649d728ea21456e4e751169ff641

SHA1
f401406fbcfa6fd8f2c211778dbbf8d36a986b28

SHA256
aef801fd40d4e9d4740818c83605075fe13d4bfc3999d40729d902a4fcfde0ba

SHA512
ab04f314431fba86d57b751bc821e35d3de1718d6a3b354431a19f4dc663808f36f2d61bdf7a040449629db77e9e10b062d8a39c24631255890be2010bbe11a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61629.exe

Filesize
468KB

MD5
0f7b677c0c4974be797ce9a320ceadea

SHA1
ba2318036b6bf43c33b5057d51ee9bfc82c23d07

SHA256
569d29b9f0a91957f8376dbd0c55244c5a59e3b1c74abebec14449d3823c44ae

SHA512
02604da7763222932e8ce25a093b471fd19ac13a3fa9a4af407b691d3387e3bd219610249aa13fd5d6fdf0c9ebc316a42e980e491b6bb8af30018efa5fe43e6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61642.exe

Filesize
468KB

MD5
d1321b66a74d579e6d885bee48010f94

SHA1
d2b8c2308698c0c2aa0050d12a8e04a38de44c44

SHA256
667bef537c34e995f1caca5ff69679d8b40024129d7ea9e8612d3d1397ed8d7c

SHA512
501c3c771eb33203b075a930f44662740cb3e102943ceb0050f494ca76ab4c13553d34d6932cb728216e663f795983b2cd0857d4b73a50596512a2f242ca4c23

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62221.exe

Filesize
468KB

MD5
cd0863441380a926c2c2ca226278e924

SHA1
e56317e72ff3dae6ba5c9a872ea4dfe8f60b8397

SHA256
092a7dde8017dc5919fed1040969a42c797a4364c76d13e536279f881fd3345d

SHA512
8f1f6c28be5afb15d6d1a68fcfd4e7c14c3cfca393946096039aa332ead63d0cd9cb48698ab1318a7eab4275c7b64e1c8d62cd681162343ebade722b829f7840

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63793.exe

Filesize
468KB

MD5
4188b47338504e6c84da8dc6fcca372b

SHA1
29e72d9f3a99abde65edcf795f1886ccf29947a6

SHA256
a692320110cd75ba7dc720441cdec0f8eb827cfd1a76b4b93bafd3e44171dceb

SHA512
d3a31796b4166ed4faff9d5ca48af05fd3793124557c68ecea4bd6fb9073da7c74f079b8b7181917149ff103431462991e371805eb1933703c5803dc88b9ba63

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads