e8773d717f908183c67a783c7433bb00653153f4911ea860a771473dfa6eeb1b

Analysis

max time kernel
120s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2024, 01:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

32485f7c628331a624e8df98ae87ada0N.exe
Size

468KB
MD5

32485f7c628331a624e8df98ae87ada0
SHA1

542097ca59e7de3908f0593d5086d89d423dc0dd
SHA256

e8773d717f908183c67a783c7433bb00653153f4911ea860a771473dfa6eeb1b
SHA512

2ca0596e521d3612ed499e0a31429bdfbee96f92adb1ae284954b7906ad7ea13b25425a52586d33eb9858a90386b142cab43b9233bb0ce129c0bad4dc165e5e7
SSDEEP

3072:thoBowLdjy8U6bYCfz52ff55Chj6IpBnmHdKV4/NIQ37SCOm5lO:thyoYLU6hf12ffn0EnNIueCOm

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2844	Unicorn-12594.exe
4616	Unicorn-15888.exe
4976	Unicorn-10931.exe
2504	Unicorn-4684.exe
4636	Unicorn-470.exe
4388	Unicorn-37549.exe
4412	Unicorn-14205.exe
5088	Unicorn-5839.exe
4556	Unicorn-691.exe
5084	Unicorn-21133.exe
1588	Unicorn-36400.exe
456	Unicorn-53997.exe
1252	Unicorn-47867.exe
4260	Unicorn-4038.exe
2864	Unicorn-34323.exe
4408	Unicorn-42768.exe
1728	Unicorn-45840.exe
5116	Unicorn-57691.exe
2548	Unicorn-43956.exe
1220	Unicorn-21741.exe
988	Unicorn-21933.exe
836	Unicorn-21933.exe
2588	Unicorn-4911.exe
2152	Unicorn-61518.exe
3396	Unicorn-65108.exe
2692	Unicorn-19437.exe
3224	Unicorn-48087.exe
1568	Unicorn-61822.exe
4656	Unicorn-52612.exe
1680	Unicorn-33011.exe
2084	Unicorn-9644.exe
4016	Unicorn-38102.exe
4552	Unicorn-9042.exe
4632	Unicorn-56852.exe
3656	Unicorn-51152.exe
5112	Unicorn-12349.exe
4264	Unicorn-36077.exe
1388	Unicorn-64919.exe
2304	Unicorn-33700.exe
3184	Unicorn-2444.exe
4504	Unicorn-1686.exe
3692	Unicorn-37805.exe
1140	Unicorn-7763.exe
780	Unicorn-44048.exe
1768	Unicorn-5245.exe
412	Unicorn-32237.exe
3648	Unicorn-32237.exe
3564	Unicorn-15215.exe
3348	Unicorn-33005.exe
3020	Unicorn-42718.exe
716	Unicorn-48848.exe
2564	Unicorn-54635.exe
1512	Unicorn-59351.exe
2100	Unicorn-13679.exe
1076	Unicorn-13679.exe
2240	Unicorn-13871.exe
5092	Unicorn-46580.exe
3888	Unicorn-6003.exe
1476	Unicorn-25338.exe
4804	Unicorn-31396.exe
1100	Unicorn-11795.exe
2320	Unicorn-51291.exe
2380	Unicorn-37555.exe
856	Unicorn-57421.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
9552	5372	WerFault.exe	231
10664	5136	WerFault.exe	228
12228	7600	WerFault.exe	323

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21133.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5862.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46560.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55469.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46451.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52281.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5862.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29014.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50189.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52669.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40778.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44951.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15795.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33933.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62595.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15423.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4505.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47103.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13481.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38105.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23775.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39274.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52253.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53923.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61716.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4354.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14460.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55834.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42718.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43647.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46957.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60918.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7986.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35815.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33043.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33933.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49923.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7986.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39818.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44048.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4354.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57276.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48471.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40723.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51356.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23452.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13061.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46560.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30419.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43956.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58307.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58832.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5862.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3366.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37805.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57657.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18786.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28706.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16788	dwm.exe
Token: SeChangeNotifyPrivilege	16788	dwm.exe
Token: 33	16788	dwm.exe
Token: SeIncBasePriorityPrivilege	16788	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
5104	32485f7c628331a624e8df98ae87ada0N.exe
2844	Unicorn-12594.exe
4616	Unicorn-15888.exe
4976	Unicorn-10931.exe
2504	Unicorn-4684.exe
4412	Unicorn-14205.exe
4636	Unicorn-470.exe
4388	Unicorn-37549.exe
5088	Unicorn-5839.exe
4556	Unicorn-691.exe
1588	Unicorn-36400.exe
5084	Unicorn-21133.exe
4260	Unicorn-4038.exe
456	Unicorn-53997.exe
2864	Unicorn-34323.exe
1252	Unicorn-47867.exe
4408	Unicorn-42768.exe
1728	Unicorn-45840.exe
2548	Unicorn-43956.exe
5116	Unicorn-57691.exe
1220	Unicorn-21741.exe
988	Unicorn-21933.exe
2588	Unicorn-4911.exe
2152	Unicorn-61518.exe
836	Unicorn-21933.exe
2692	Unicorn-19437.exe
1568	Unicorn-61822.exe
4656	Unicorn-52612.exe
3224	Unicorn-48087.exe
1680	Unicorn-33011.exe
3396	Unicorn-65108.exe
2084	Unicorn-9644.exe
4552	Unicorn-9042.exe
4632	Unicorn-56852.exe
3656	Unicorn-51152.exe
5112	Unicorn-12349.exe
4264	Unicorn-36077.exe
1388	Unicorn-64919.exe
2304	Unicorn-33700.exe
3184	Unicorn-2444.exe
4504	Unicorn-1686.exe
3692	Unicorn-37805.exe
1140	Unicorn-7763.exe
780	Unicorn-44048.exe
3648	Unicorn-32237.exe
412	Unicorn-32237.exe
1768	Unicorn-5245.exe
3564	Unicorn-15215.exe
716	Unicorn-48848.exe
2564	Unicorn-54635.exe
3348	Unicorn-33005.exe
3020	Unicorn-42718.exe
4804	Unicorn-31396.exe
1076	Unicorn-13679.exe
2240	Unicorn-13871.exe
3888	Unicorn-6003.exe
1512	Unicorn-59351.exe
2100	Unicorn-13679.exe
1476	Unicorn-25338.exe
1100	Unicorn-11795.exe
5092	Unicorn-46580.exe
2380	Unicorn-37555.exe
2320	Unicorn-51291.exe
856	Unicorn-57421.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 2844	5104	32485f7c628331a624e8df98ae87ada0N.exe	84
PID 5104 wrote to memory of 2844	5104	32485f7c628331a624e8df98ae87ada0N.exe	84
PID 5104 wrote to memory of 2844	5104	32485f7c628331a624e8df98ae87ada0N.exe	84
PID 2844 wrote to memory of 4616	2844	Unicorn-12594.exe	85
PID 2844 wrote to memory of 4616	2844	Unicorn-12594.exe	85
PID 2844 wrote to memory of 4616	2844	Unicorn-12594.exe	85
PID 5104 wrote to memory of 4976	5104	32485f7c628331a624e8df98ae87ada0N.exe	86
PID 5104 wrote to memory of 4976	5104	32485f7c628331a624e8df98ae87ada0N.exe	86
PID 5104 wrote to memory of 4976	5104	32485f7c628331a624e8df98ae87ada0N.exe	86
PID 4616 wrote to memory of 2504	4616	Unicorn-15888.exe	87
PID 4616 wrote to memory of 2504	4616	Unicorn-15888.exe	87
PID 4616 wrote to memory of 2504	4616	Unicorn-15888.exe	87
PID 2844 wrote to memory of 4636	2844	Unicorn-12594.exe	88
PID 2844 wrote to memory of 4636	2844	Unicorn-12594.exe	88
PID 2844 wrote to memory of 4636	2844	Unicorn-12594.exe	88
PID 4976 wrote to memory of 4388	4976	Unicorn-10931.exe	89
PID 4976 wrote to memory of 4388	4976	Unicorn-10931.exe	89
PID 4976 wrote to memory of 4388	4976	Unicorn-10931.exe	89
PID 5104 wrote to memory of 4412	5104	32485f7c628331a624e8df98ae87ada0N.exe	90
PID 5104 wrote to memory of 4412	5104	32485f7c628331a624e8df98ae87ada0N.exe	90
PID 5104 wrote to memory of 4412	5104	32485f7c628331a624e8df98ae87ada0N.exe	90
PID 2504 wrote to memory of 5088	2504	Unicorn-4684.exe	91
PID 2504 wrote to memory of 5088	2504	Unicorn-4684.exe	91
PID 2504 wrote to memory of 5088	2504	Unicorn-4684.exe	91
PID 4616 wrote to memory of 4556	4616	Unicorn-15888.exe	92
PID 4616 wrote to memory of 4556	4616	Unicorn-15888.exe	92
PID 4616 wrote to memory of 4556	4616	Unicorn-15888.exe	92
PID 4636 wrote to memory of 5084	4636	Unicorn-470.exe	93
PID 4636 wrote to memory of 5084	4636	Unicorn-470.exe	93
PID 4636 wrote to memory of 5084	4636	Unicorn-470.exe	93
PID 4412 wrote to memory of 1588	4412	Unicorn-14205.exe	94
PID 4412 wrote to memory of 1588	4412	Unicorn-14205.exe	94
PID 4412 wrote to memory of 1588	4412	Unicorn-14205.exe	94
PID 4388 wrote to memory of 456	4388	Unicorn-37549.exe	96
PID 4388 wrote to memory of 456	4388	Unicorn-37549.exe	96
PID 4388 wrote to memory of 456	4388	Unicorn-37549.exe	96
PID 2844 wrote to memory of 1252	2844	Unicorn-12594.exe	95
PID 2844 wrote to memory of 1252	2844	Unicorn-12594.exe	95
PID 2844 wrote to memory of 1252	2844	Unicorn-12594.exe	95
PID 4976 wrote to memory of 2864	4976	Unicorn-10931.exe	97
PID 4976 wrote to memory of 2864	4976	Unicorn-10931.exe	97
PID 4976 wrote to memory of 2864	4976	Unicorn-10931.exe	97
PID 5104 wrote to memory of 4260	5104	32485f7c628331a624e8df98ae87ada0N.exe	98
PID 5104 wrote to memory of 4260	5104	32485f7c628331a624e8df98ae87ada0N.exe	98
PID 5104 wrote to memory of 4260	5104	32485f7c628331a624e8df98ae87ada0N.exe	98
PID 5088 wrote to memory of 4408	5088	Unicorn-5839.exe	99
PID 5088 wrote to memory of 4408	5088	Unicorn-5839.exe	99
PID 5088 wrote to memory of 4408	5088	Unicorn-5839.exe	99
PID 4556 wrote to memory of 1728	4556	Unicorn-691.exe	100
PID 4556 wrote to memory of 1728	4556	Unicorn-691.exe	100
PID 4556 wrote to memory of 1728	4556	Unicorn-691.exe	100
PID 4616 wrote to memory of 5116	4616	Unicorn-15888.exe	101
PID 4616 wrote to memory of 5116	4616	Unicorn-15888.exe	101
PID 4616 wrote to memory of 5116	4616	Unicorn-15888.exe	101
PID 2504 wrote to memory of 2548	2504	Unicorn-4684.exe	102
PID 2504 wrote to memory of 2548	2504	Unicorn-4684.exe	102
PID 2504 wrote to memory of 2548	2504	Unicorn-4684.exe	102
PID 4260 wrote to memory of 1220	4260	Unicorn-4038.exe	103
PID 4260 wrote to memory of 1220	4260	Unicorn-4038.exe	103
PID 4260 wrote to memory of 1220	4260	Unicorn-4038.exe	103
PID 2864 wrote to memory of 988	2864	Unicorn-34323.exe	104
PID 2864 wrote to memory of 988	2864	Unicorn-34323.exe	104
PID 2864 wrote to memory of 988	2864	Unicorn-34323.exe	104
PID 5084 wrote to memory of 836	5084	Unicorn-21133.exe	105

C:\Users\Admin\AppData\Local\Temp\32485f7c628331a624e8df98ae87ada0N.exe
"C:\Users\Admin\AppData\Local\Temp\32485f7c628331a624e8df98ae87ada0N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12594.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12594.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15888.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15888.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4684.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5839.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42768.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9644.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57421.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21229.exe
        9⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4539.exe
        10⤵
        
        PID:7824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65283.exe
        10⤵
        
        PID:11348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43852.exe
        10⤵
        
        PID:14560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe
        9⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38105.exe
        9⤵
        
        PID:13264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16785.exe
        9⤵
        
        PID:11132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33174.exe
        8⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45881.exe
        9⤵
        
        PID:8736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62723.exe
        9⤵
        
        PID:12696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45843.exe
        9⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20233.exe
        8⤵
        
        PID:8036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57136.exe
        8⤵
        
        PID:12068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9643.exe
        8⤵
        
        PID:15908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37555.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21229.exe
        8⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54233.exe
        9⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12159.exe
        9⤵
        
        PID:9424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62669.exe
        9⤵
        
        PID:14184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47821.exe
        9⤵
        
        PID:16028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10249.exe
        8⤵
        
        PID:8268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41680.exe
        8⤵
        
        PID:12220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41474.exe
        8⤵
        
        PID:9872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8104.exe
        8⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11549.exe
        7⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54233.exe
        8⤵
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46268.exe
        9⤵
        
        PID:12724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49677.exe
        9⤵
        
        PID:15780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12159.exe
        8⤵
        
        PID:10124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62669.exe
        8⤵
        
        PID:12776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52886.exe
        8⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56858.exe
        7⤵
        
        PID:9524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55053.exe
        8⤵
        
        PID:16380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19243.exe
        7⤵
        
        PID:14008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20209.exe
        7⤵
        
        PID:1084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38102.exe
        6⤵
        Executes dropped EXE
        
        PID:4016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19123.exe
        7⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64569.exe
        8⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1723.exe
        9⤵
        
        PID:10044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29052.exe
        9⤵
        
        PID:13024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64650.exe
        9⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39085.exe
        9⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36706.exe
        8⤵
        
        PID:10008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38727.exe
        8⤵
        
        PID:13588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60150.exe
        8⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22793.exe
        7⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58832.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43130.exe
        7⤵
        
        PID:14188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7266.exe
        7⤵
        
        PID:14668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30950.exe
        7⤵
        
        PID:6216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51291.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24973.exe
        7⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62073.exe
        8⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43737.exe
        9⤵
        
        PID:10636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48934.exe
        9⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39085.exe
        9⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2306.exe
        8⤵
        
        PID:10180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5862.exe
        8⤵
        
        PID:13524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4505.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23775.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9080.exe
        8⤵
        
        PID:10856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17004.exe
        8⤵
        
        PID:15996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
        7⤵
        
        PID:10296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50189.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64666.exe
        7⤵
        
        PID:15696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37383.exe
        6⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52089.exe
        7⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49110.exe
        8⤵
        
        PID:13368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37346.exe
        8⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60451.exe
        7⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3366.exe
        7⤵
        
        PID:13840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60918.exe
        7⤵
        
        PID:2284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23382.exe
        6⤵
        
        PID:7268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3362.exe
        6⤵
        
        PID:10628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50575.exe
        6⤵
        
        PID:14544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35473.exe
        6⤵
        
        PID:15264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4084.exe
        6⤵
        
        PID:6768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43956.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51152.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3695.exe
        7⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21229.exe
        8⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-216.exe
        9⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42428.exe
        9⤵
        
        PID:10724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26083.exe
        9⤵
        
        PID:15272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9621.exe
        9⤵
        
        PID:17320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15042.exe
        8⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5496.exe
        9⤵
        
        PID:9448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48934.exe
        9⤵
        
        PID:14168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53357.exe
        9⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13481.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30341.exe
        8⤵
        
        PID:16020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63351.exe
        7⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5136 -s 640
        8⤵
        Program crash
        
        PID:10664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5158.exe
        7⤵
        
        PID:8600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16786.exe
        7⤵
        
        PID:12688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15458.exe
        7⤵
        
        PID:17032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24499.exe
        6⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15795.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60572.exe
        8⤵
        
        PID:8696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39103.exe
        9⤵
        
        PID:15992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47264.exe
        8⤵
        
        PID:12780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17970.exe
        8⤵
        
        PID:16032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32659.exe
        7⤵
        
        PID:9608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22838.exe
        7⤵
        
        PID:12832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47407.exe
        7⤵
        
        PID:15932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4829.exe
        6⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59222.exe
        7⤵
        
        PID:9552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48934.exe
        7⤵
        
        PID:14276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40778.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2767.exe
        6⤵
        
        PID:7204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49047.exe
        6⤵
        
        PID:12144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24718.exe
        6⤵
        
        PID:15572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12349.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36560.exe
        6⤵
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2739.exe
        7⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49689.exe
        8⤵
        
        PID:10952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37532.exe
        8⤵
        
        PID:13900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52669.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41578.exe
        7⤵
        
        PID:8792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58982.exe
        7⤵
        
        PID:15136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18155.exe
        7⤵
        
        PID:16924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50295.exe
        6⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65212.exe
        7⤵
        
        PID:9488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61379.exe
        7⤵
        
        PID:12616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45843.exe
        7⤵
        
        PID:15236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64743.exe
        6⤵
        
        PID:8428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48883.exe
        6⤵
        
        PID:12660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38316.exe
        6⤵
        
        PID:2108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18147.exe
        5⤵
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4207.exe
        6⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7062.exe
        6⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27900.exe
        7⤵
        
        PID:8964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61379.exe
        7⤵
        
        PID:12404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45843.exe
        7⤵
        
        PID:1492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21126.exe
        6⤵
        
        PID:9108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18713.exe
        6⤵
        
        PID:13972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27650.exe
        6⤵
        
        PID:4956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26538.exe
        5⤵
        
        PID:1924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65020.exe
        6⤵
        
        PID:9452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61379.exe
        6⤵
        
        PID:12420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60918.exe
        6⤵
        
        PID:2732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-898.exe
        5⤵
        
        PID:8008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40748.exe
        5⤵
        
        PID:12652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26109.exe
        5⤵
        
        PID:16188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-691.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45840.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9042.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-623.exe
        7⤵
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56205.exe
        8⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1627.exe
        9⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47551.exe
        10⤵
        
        PID:15904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59683.exe
        9⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3366.exe
        9⤵
        
        PID:13716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35347.exe
        9⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30419.exe
        9⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56938.exe
        8⤵
        
        PID:8100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50675.exe
        8⤵
        
        PID:11480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49649.exe
        8⤵
        
        PID:10268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56631.exe
        7⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8408.exe
        8⤵
        
        PID:7752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61379.exe
        8⤵
        
        PID:12396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45843.exe
        8⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11977.exe
        7⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57712.exe
        7⤵
        
        PID:12108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7653.exe
        7⤵
        
        PID:16316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44951.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20653.exe
        7⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19519.exe
        8⤵
        
        PID:10156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5862.exe
        8⤵
        
        PID:13564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5269.exe
        8⤵
        
        PID:1192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe
        7⤵
        
        PID:9684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38105.exe
        7⤵
        
        PID:13064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12642.exe
        7⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30950.exe
        7⤵
        
        PID:1660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8669.exe
        6⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44345.exe
        7⤵
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38111.exe
        7⤵
        
        PID:12196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-181.exe
        7⤵
        
        PID:15752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58963.exe
        6⤵
        
        PID:8184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59619.exe
        6⤵
        
        PID:12996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52881.exe
        6⤵
        
        PID:15588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56852.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49549.exe
        6⤵
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35344.exe
        7⤵
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57657.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1723.exe
        9⤵
        
        PID:9712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29052.exe
        9⤵
        
        PID:13396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26988.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36706.exe
        8⤵
        
        PID:10076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5862.exe
        8⤵
        
        PID:13500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5500.exe
        8⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20703.exe
        7⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13958.exe
        7⤵
        
        PID:8660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36796.exe
        7⤵
        
        PID:15164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20674.exe
        7⤵
        
        PID:16052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60471.exe
        6⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51356.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18786.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55565.exe
        7⤵
        
        PID:12228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40723.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30419.exe
        7⤵
        
        PID:16824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53098.exe
        6⤵
        
        PID:8112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56944.exe
        6⤵
        
        PID:12032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31668.exe
        6⤵
        
        PID:9668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13818.exe
        5⤵
        
        PID:3716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33933.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26169.exe
        7⤵
        
        PID:7436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4354.exe
        7⤵
        
        PID:10916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46468.exe
        7⤵
        
        PID:15208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31801.exe
        7⤵
        
        PID:15896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20639.exe
        6⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55676.exe
        7⤵
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63658.exe
        6⤵
        
        PID:11868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40325.exe
        6⤵
        
        PID:15548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24644.exe
        5⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7992.exe
        6⤵
        
        PID:11244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2940.exe
        6⤵
        
        PID:14016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40586.exe
        6⤵
        
        PID:11300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38778.exe
        5⤵
        
        PID:7652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55779.exe
        5⤵
        
        PID:12296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31252.exe
        5⤵
        
        PID:16368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57691.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36077.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8786.exe
        6⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30093.exe
        7⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12824.exe
        8⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14014.exe
        9⤵
        
        PID:15060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55558.exe
        9⤵
        
        PID:15404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61379.exe
        8⤵
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52861.exe
        8⤵
        
        PID:16820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17567.exe
        7⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43018.exe
        7⤵
        
        PID:12600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52445.exe
        7⤵
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20886.exe
        6⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23452.exe
        7⤵
        
        PID:11232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2940.exe
        7⤵
        
        PID:14084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39085.exe
        7⤵
        
        PID:1808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13359.exe
        6⤵
        
        PID:9908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44183.exe
        6⤵
        
        PID:4996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53391.exe
        6⤵
        
        PID:16276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24499.exe
        5⤵
        
        PID:468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27088.exe
        6⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42809.exe
        7⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49923.exe
        7⤵
        
        PID:11808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54989.exe
        7⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33043.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30419.exe
        7⤵
        
        PID:6532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53283.exe
        6⤵
        
        PID:7948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44810.exe
        6⤵
        
        PID:11488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25250.exe
        6⤵
        
        PID:16332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51041.exe
        5⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26169.exe
        6⤵
        
        PID:7420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4354.exe
        6⤵
        
        PID:9632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46468.exe
        6⤵
        
        PID:7632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30950.exe
        6⤵
        
        PID:6732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40240.exe
        5⤵
        
        PID:7688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60858.exe
        5⤵
        
        PID:11744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42129.exe
        5⤵
        
        PID:16564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33700.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19181.exe
        5⤵
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44877.exe
        6⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34300.exe
        7⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54204.exe
        8⤵
        
        PID:10316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48934.exe
        8⤵
        
        PID:14256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7986.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59683.exe
        7⤵
        
        PID:8676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3366.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60150.exe
        7⤵
        
        PID:3532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28866.exe
        6⤵
        
        PID:6512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17222.exe
        6⤵
        
        PID:10400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4316.exe
        6⤵
        
        PID:15224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21250.exe
        6⤵
        
        PID:16664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37305.exe
        5⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26745.exe
        6⤵
        
        PID:7608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46560.exe
        6⤵
        
        PID:11100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62669.exe
        6⤵
        
        PID:7152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47069.exe
        6⤵
        
        PID:15848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2278.exe
        5⤵
        
        PID:7760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3986.exe
        5⤵
        
        PID:11772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31668.exe
        5⤵
        
        PID:16160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35434.exe
      4⤵
      PID:2260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19283.exe
        5⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53273.exe
        6⤵
        
        PID:7892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15423.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19628.exe
        6⤵
        
        PID:13900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31993.exe
        6⤵
        
        PID:15704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe
        5⤵
        
        PID:9676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38105.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20805.exe
        5⤵
        
        PID:1416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30950.exe
        5⤵
        
        PID:6372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41523.exe
      4⤵
      PID:6068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22716.exe
        5⤵
        
        PID:7500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49923.exe
        5⤵
        
        PID:11848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54989.exe
        5⤵
        
        PID:13308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48118.exe
        5⤵
        
        PID:2420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30419.exe
        5⤵
        
        PID:6704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34985.exe
      4⤵
      PID:8132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28046.exe
      4⤵
      PID:12128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42722.exe
      4⤵
      PID:16888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21133.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21933.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15215.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51568.exe
        7⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23123.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62300.exe
        9⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50122.exe
        9⤵
        
        PID:12140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13736.exe
        9⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56295.exe
        8⤵
        
        PID:8496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16786.exe
        8⤵
        
        PID:12704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57742.exe
        8⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35603.exe
        7⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7800.exe
        8⤵
        
        PID:11208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2940.exe
        8⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7913.exe
        8⤵
        
        PID:9420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42922.exe
        7⤵
        
        PID:8900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25350.exe
        7⤵
        
        PID:15052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45492.exe
        7⤵
        
        PID:16524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58423.exe
        6⤵
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25677.exe
        7⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34972.exe
        8⤵
        
        PID:9288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30588.exe
        8⤵
        
        PID:13476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59853.exe
        8⤵
        
        PID:16128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48704.exe
        7⤵
        
        PID:7480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32521.exe
        7⤵
        
        PID:12260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38316.exe
        7⤵
        
        PID:10640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56542.exe
        6⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22716.exe
        7⤵
        
        PID:7456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49923.exe
        7⤵
        
        PID:11832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37177.exe
        7⤵
        
        PID:13464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60432.exe
        6⤵
        
        PID:8652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58199.exe
        6⤵
        
        PID:12796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52975.exe
        6⤵
        
        PID:16180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11244.exe
        6⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23065.exe
        7⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23452.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2940.exe
        8⤵
        
        PID:13884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        8⤵
        
        PID:13308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43647.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3366.exe
        7⤵
        
        PID:13616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62454.exe
        7⤵
        
        PID:14964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22431.exe
        6⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25625.exe
        7⤵
        
        PID:11536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28517.exe
        7⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33219.exe
        7⤵
        
        PID:6696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49895.exe
        6⤵
        
        PID:10376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31222.exe
        6⤵
        
        PID:13824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41018.exe
        6⤵
        
        PID:15648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52219.exe
        5⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
        6⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19321.exe
        7⤵
        
        PID:10116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29052.exe
        7⤵
        
        PID:14488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20076.exe
        7⤵
        
        PID:16936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6367.exe
        6⤵
        
        PID:8400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45930.exe
        6⤵
        
        PID:14216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50451.exe
        6⤵
        
        PID:15596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16562.exe
        5⤵
        
        PID:7212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55834.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6748.exe
        5⤵
        
        PID:15176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38316.exe
        5⤵
        
        PID:11140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65108.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32237.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36493.exe
        6⤵
        
        PID:224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19984.exe
        7⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8216.exe
        8⤵
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62723.exe
        8⤵
        
        PID:12680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49875.exe
        8⤵
        
        PID:17288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6498.exe
        7⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51847.exe
        7⤵
        
        PID:12188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63206.exe
        7⤵
        
        PID:16056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19158.exe
        6⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41273.exe
        7⤵
        
        PID:8664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58794.exe
        7⤵
        
        PID:10732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13717.exe
        7⤵
        
        PID:10468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13558.exe
        7⤵
        
        PID:11556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25926.exe
        6⤵
        
        PID:8968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28624.exe
        6⤵
        
        PID:12336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23996.exe
        6⤵
        
        PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42771.exe
        5⤵
        
        PID:4808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60729.exe
        6⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16249.exe
        7⤵
        
        PID:10840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14460.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41956.exe
        7⤵
        
        PID:16096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57955.exe
        6⤵
        
        PID:9408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3366.exe
        6⤵
        
        PID:13708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37177.exe
        6⤵
        
        PID:15440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53162.exe
        5⤵
        
        PID:7112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54800.exe
        5⤵
        
        PID:10308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41524.exe
        5⤵
        
        PID:14600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41666.exe
        5⤵
        
        PID:13300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30569.exe
        5⤵
        
        PID:7376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42718.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63571.exe
        5⤵
        
        PID:1912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2680.exe
        6⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15320.exe
        7⤵
        
        PID:8140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51466.exe
        7⤵
        
        PID:11756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46957.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9852.exe
        7⤵
        
        PID:12228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21951.exe
        7⤵
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42559.exe
        6⤵
        
        PID:8504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60807.exe
        6⤵
        
        PID:12748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41210.exe
        6⤵
        
        PID:15472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12322.exe
        5⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32444.exe
        6⤵
        
        PID:12628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33285.exe
        6⤵
        
        PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22598.exe
        5⤵
        
        PID:9484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48653.exe
        5⤵
        
        PID:12432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46877.exe
        5⤵
        
        PID:16008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6342.exe
      4⤵
      PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7579.exe
        5⤵
        
        PID:1772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1723.exe
        6⤵
        
        PID:9296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29052.exe
        6⤵
        
        PID:13340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34793.exe
        6⤵
        
        PID:15728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36706.exe
        5⤵
        
        PID:10068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5862.exe
        5⤵
        
        PID:13508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18517.exe
        5⤵
        
        PID:12384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50132.exe
        5⤵
        
        PID:16444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40279.exe
      4⤵
      PID:5812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64348.exe
        5⤵
        
        PID:13360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57094.exe
        5⤵
        
        PID:2944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3263.exe
      4⤵
      PID:9436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40518.exe
      4⤵
      PID:12788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3188.exe
      4⤵
      PID:4816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47867.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47867.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64919.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19181.exe
        5⤵
        
        PID:2208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33933.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7419.exe
        7⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31074.exe
        7⤵
        
        PID:11472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24764.exe
        7⤵
        
        PID:15464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23519.exe
        6⤵
        
        PID:6936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51955.exe
        6⤵
        
        PID:13012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5052.exe
        6⤵
        
        PID:14592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13884.exe
        6⤵
        
        PID:6212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1011.exe
        5⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23196.exe
        6⤵
        
        PID:12244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26988.exe
        6⤵
        
        PID:2348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39274.exe
        5⤵
        
        PID:8564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1135.exe
        5⤵
        
        PID:12732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53967.exe
        5⤵
        
        PID:5580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38235.exe
      4⤵
      PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47181.exe
        5⤵
        
        PID:5588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52281.exe
        6⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24764.exe
        7⤵
        
        PID:13648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39978.exe
        7⤵
        
        PID:16152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59683.exe
        6⤵
        
        PID:8744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3366.exe
        6⤵
        
        PID:13724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29014.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29442.exe
        5⤵
        
        PID:7184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
        5⤵
        
        PID:10496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10028.exe
        5⤵
        
        PID:14400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36133.exe
        5⤵
        
        PID:13876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61924.exe
      4⤵
      PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58137.exe
        5⤵
        
        PID:10056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32194.exe
        5⤵
        
        PID:14196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46451.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60983.exe
      4⤵
      PID:8412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23682.exe
      4⤵
      PID:12640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43229.exe
      4⤵
      PID:2196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52612.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52612.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33005.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34576.exe
        5⤵
        
        PID:1936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26928.exe
        6⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1723.exe
        7⤵
        
        PID:9980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39597.exe
        7⤵
        
        PID:15184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61334.exe
        7⤵
        
        PID:16104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36706.exe
        6⤵
        
        PID:10016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5862.exe
        6⤵
        
        PID:13556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53043.exe
        6⤵
        
        PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34719.exe
        5⤵
        
        PID:6896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10456.exe
        6⤵
        
        PID:13860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13061.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52967.exe
        5⤵
        
        PID:10128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51795.exe
        5⤵
        
        PID:14160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20348.exe
        5⤵
        
        PID:4024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13491.exe
      4⤵
      PID:6024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55388.exe
        5⤵
        
        PID:7588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49923.exe
        5⤵
        
        PID:11824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8345.exe
        5⤵
        
        PID:15560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2278.exe
      4⤵
      PID:7848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25343.exe
      4⤵
      PID:11532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56047.exe
      4⤵
      PID:16248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54635.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54635.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59373.exe
      4⤵
      PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61020.exe
        5⤵
        
        PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39231.exe
        5⤵
        
        PID:10204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35597.exe
        5⤵
        
        PID:14612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46301.exe
        5⤵
        
        PID:16876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47424.exe
      4⤵
      PID:7236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43737.exe
        5⤵
        
        PID:11040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48934.exe
        5⤵
        
        PID:14552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64234.exe
        5⤵
        
        PID:5416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35792.exe
      4⤵
      PID:11512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24526.exe
      4⤵
      PID:15608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48243.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48243.exe
    3⤵
    PID:5956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13016.exe
      4⤵
      PID:8296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40994.exe
      4⤵
      PID:12576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45843.exe
      4⤵
      PID:3596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34409.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34409.exe
    3⤵
    PID:3220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39857.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39857.exe
    3⤵
    PID:11724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47659.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47659.exe
    3⤵
    PID:15720
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10931.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10931.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37549.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37549.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53997.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19437.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32237.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21008.exe
        7⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47223.exe
        8⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8504.exe
        9⤵
        
        PID:12588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12105.exe
        9⤵
        
        PID:15972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20550.exe
        8⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18713.exe
        8⤵
        
        PID:13944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3813.exe
        8⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16086.exe
        7⤵
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43545.exe
        8⤵
        
        PID:11216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48934.exe
        8⤵
        
        PID:14240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64234.exe
        8⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4297.exe
        7⤵
        
        PID:8684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55994.exe
        7⤵
        
        PID:13048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15749.exe
        7⤵
        
        PID:15964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16627.exe
        6⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9147.exe
        7⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4354.exe
        7⤵
        
        PID:10832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46468.exe
        7⤵
        
        PID:15152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41786.exe
        7⤵
        
        PID:16108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7910.exe
        6⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47385.exe
        7⤵
        
        PID:10944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45021.exe
        7⤵
        
        PID:15212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39818.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58832.exe
        6⤵
        
        PID:9692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39988.exe
        6⤵
        
        PID:13392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48322.exe
        6⤵
        
        PID:16432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59351.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43120.exe
        6⤵
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
        7⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43289.exe
        8⤵
        
        PID:12560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44010.exe
        8⤵
        
        PID:16340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1862.exe
        7⤵
        
        PID:11184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14747.exe
        8⤵
        
        PID:13260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39013.exe
        8⤵
        
        PID:16980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60243.exe
        7⤵
        
        PID:13920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51485.exe
        7⤵
        
        PID:15492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62499.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63242.exe
        6⤵
        
        PID:10540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31222.exe
        6⤵
        
        PID:13856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7356.exe
        6⤵
        
        PID:10272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13884.exe
        6⤵
        
        PID:6436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51326.exe
        5⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61340.exe
        6⤵
        
        PID:8712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62723.exe
        6⤵
        
        PID:13068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        6⤵
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23219.exe
        5⤵
        
        PID:7772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26178.exe
        5⤵
        
        PID:12496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49041.exe
        5⤵
        
        PID:16228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48087.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44048.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51568.exe
        6⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25677.exe
        7⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41849.exe
        8⤵
        
        PID:7284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49923.exe
        8⤵
        
        PID:11840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64858.exe
        8⤵
        
        PID:16772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48704.exe
        7⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49543.exe
        7⤵
        
        PID:12232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29765.exe
        7⤵
        
        PID:16860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1011.exe
        6⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10520.exe
        7⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46090.exe
        7⤵
        
        PID:13028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34771.exe
        7⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16726.exe
        7⤵
        
        PID:8752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39274.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1327.exe
        6⤵
        
        PID:12820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35717.exe
        6⤵
        
        PID:1400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25750.exe
        5⤵
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55161.exe
        6⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48060.exe
        7⤵
        
        PID:11280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48934.exe
        7⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39818.exe
        7⤵
        
        PID:15944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25858.exe
        6⤵
        
        PID:9384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3366.exe
        6⤵
        
        PID:13732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9305.exe
        6⤵
        
        PID:15876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53162.exe
        5⤵
        
        PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54800.exe
        5⤵
        
        PID:10288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62109.exe
        5⤵
        
        PID:12888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20785.exe
        5⤵
        
        PID:16308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5245.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62637.exe
        5⤵
        
        PID:4256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35353.exe
        6⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17148.exe
        7⤵
        
        PID:8324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53408.exe
        7⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60150.exe
        7⤵
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12191.exe
        6⤵
        
        PID:8976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22566.exe
        6⤵
        
        PID:12304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52851.exe
        6⤵
        
        PID:14104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44803.exe
        5⤵
        
        PID:7148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63996.exe
        6⤵
        
        PID:10820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14460.exe
        6⤵
        
        PID:14952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53357.exe
        6⤵
        
        PID:432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22598.exe
        5⤵
        
        PID:9388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48653.exe
        5⤵
        
        PID:12672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24377.exe
        5⤵
        
        PID:13940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13884.exe
        5⤵
        
        PID:6728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2598.exe
      4⤵
      PID:3128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11660.exe
        5⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23996.exe
        6⤵
        
        PID:10536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23938.exe
        6⤵
        
        PID:16948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36706.exe
        5⤵
        
        PID:10024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5862.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60918.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45655.exe
      4⤵
      PID:6752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58620.exe
        5⤵
        
        PID:10740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48934.exe
        5⤵
        
        PID:13372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37785.exe
        5⤵
        
        PID:2816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33631.exe
      4⤵
      PID:10220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43660.exe
      4⤵
      PID:14172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53841.exe
      4⤵
      PID:15984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34323.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34323.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21933.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37805.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25808.exe
        6⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41037.exe
        7⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47993.exe
        8⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10872.exe
        9⤵
        
        PID:10624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48934.exe
        9⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47021.exe
        9⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40415.exe
        8⤵
        
        PID:11540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37444.exe
        8⤵
        
        PID:15264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30950.exe
        8⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2658.exe
        7⤵
        
        PID:512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51379.exe
        7⤵
        
        PID:12512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38316.exe
        7⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5619.exe
        6⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40665.exe
        7⤵
        
        PID:11168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2940.exe
        7⤵
        
        PID:12612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7913.exe
        7⤵
        
        PID:10304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42346.exe
        6⤵
        
        PID:8864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55741.exe
        6⤵
        
        PID:13644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31668.exe
        6⤵
        
        PID:16004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27379.exe
        5⤵
        
        PID:3420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33357.exe
        6⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15320.exe
        7⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36391.exe
        7⤵
        
        PID:11768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46957.exe
        7⤵
        
        PID:12676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23289.exe
        7⤵
        
        PID:16492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3618.exe
        6⤵
        
        PID:7796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51379.exe
        6⤵
        
        PID:12520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24674.exe
        6⤵
        
        PID:16356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51451.exe
        5⤵
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62108.exe
        6⤵
        
        PID:7020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22050.exe
        6⤵
        
        PID:11652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34021.exe
        6⤵
        
        PID:11620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62160.exe
        5⤵
        
        PID:8512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58199.exe
        5⤵
        
        PID:12740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5035.exe
        5⤵
        
        PID:16212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7763.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62512.exe
        5⤵
        
        PID:2724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4524.exe
        6⤵
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22684.exe
        7⤵
        
        PID:11108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2940.exe
        7⤵
        
        PID:14024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        7⤵
        
        PID:15368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6498.exe
        6⤵
        
        PID:8232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1606.exe
        6⤵
        
        PID:12848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41210.exe
        6⤵
        
        PID:2580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46436.exe
        5⤵
        
        PID:7164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22684.exe
        6⤵
        
        PID:11124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2940.exe
        6⤵
        
        PID:14104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        6⤵
        
        PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56307.exe
        5⤵
        
        PID:10060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3062.exe
        5⤵
        
        PID:13576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37900.exe
        5⤵
        
        PID:16236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21981.exe
      4⤵
      PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47356.exe
        5⤵
        
        PID:7060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1723.exe
        6⤵
        
        PID:10232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39597.exe
        6⤵
        
        PID:15200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9881.exe
        6⤵
        
        PID:16704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36706.exe
        5⤵
        
        PID:10048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5862.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29014.exe
        5⤵
        
        PID:4964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21455.exe
      4⤵
      PID:6792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41945.exe
        5⤵
        
        PID:12840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21605.exe
        5⤵
        
        PID:9824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29506.exe
      4⤵
      PID:11080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14405.exe
      4⤵
      PID:2420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30717.exe
      4⤵
      PID:15656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61822.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61822.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13871.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34189.exe
        5⤵
        
        PID:4472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61421.exe
        6⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54688.exe
        7⤵
        
        PID:10140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5862.exe
        7⤵
        
        PID:13492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7769.exe
        7⤵
        
        PID:16088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51776.exe
        6⤵
        
        PID:8452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58745.exe
        7⤵
        
        PID:11580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45843.exe
        7⤵
        
        PID:15448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35815.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52253.exe
        6⤵
        
        PID:1908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13782.exe
        5⤵
        
        PID:6632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40313.exe
        6⤵
        
        PID:7620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49923.exe
        6⤵
        
        PID:11712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40723.exe
        6⤵
        
        PID:1144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30419.exe
        6⤵
        
        PID:6676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20358.exe
        5⤵
        
        PID:8368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18713.exe
        5⤵
        
        PID:13956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35717.exe
        5⤵
        
        PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61716.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26169.exe
        5⤵
        
        PID:7412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4354.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46468.exe
        5⤵
        
        PID:184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13736.exe
        5⤵
        
        PID:11508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16966.exe
      4⤵
      PID:8052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48921.exe
        5⤵
        
        PID:10848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45021.exe
        5⤵
        
        PID:13916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29257.exe
        5⤵
        
        PID:5624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64343.exe
      4⤵
      PID:11228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8875.exe
      4⤵
      PID:15632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31396.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31396.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26701.exe
      4⤵
      PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52281.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32985.exe
        6⤵
        
        PID:11380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5893.exe
        6⤵
        
        PID:15244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55734.exe
        6⤵
        
        PID:15820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25858.exe
        5⤵
        
        PID:9396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3366.exe
        5⤵
        
        PID:13740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46035.exe
        5⤵
        
        PID:1992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29442.exe
      4⤵
      PID:7192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59222.exe
        5⤵
        
        PID:10868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48934.exe
        5⤵
        
        PID:14324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39818.exe
        5⤵
        
        PID:16976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58634.exe
      4⤵
      PID:10876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33485.exe
      4⤵
      PID:15008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44221.exe
      4⤵
      PID:16884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32106.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32106.exe
    3⤵
    PID:5920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59609.exe
      4⤵
      PID:7544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46560.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62669.exe
      4⤵
      PID:13940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13736.exe
      4⤵
      PID:6140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61388.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61388.exe
    3⤵
    PID:11736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9858.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9858.exe
    3⤵
    PID:15680
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14205.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14205.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36400.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36400.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4911.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13679.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5935.exe
        6⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57657.exe
        7⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23484.exe
        8⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15906.exe
        8⤵
        
        PID:11996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57053.exe
        8⤵
        
        PID:15768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6815.exe
        7⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27379.exe
        7⤵
        
        PID:13964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7461.exe
        7⤵
        
        PID:15620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20703.exe
        6⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7224.exe
        7⤵
        
        PID:11148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2940.exe
        7⤵
        
        PID:14624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40586.exe
        7⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11654.exe
        6⤵
        
        PID:9272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62358.exe
        6⤵
        
        PID:13328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53923.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56631.exe
        5⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27734.exe
        6⤵
        
        PID:9092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61379.exe
        6⤵
        
        PID:12412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60918.exe
        6⤵
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15049.exe
        5⤵
        
        PID:8388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48883.exe
        5⤵
        
        PID:12632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35717.exe
        5⤵
        
        PID:1424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11795.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16979.exe
        5⤵
        
        PID:3904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11259.exe
        6⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7600 -s 632
        7⤵
        Program crash
        
        PID:12228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46560.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62669.exe
        6⤵
        
        PID:13876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24188.exe
        6⤵
        
        PID:16296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35135.exe
        5⤵
        
        PID:7744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38169.exe
        6⤵
        
        PID:10236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21445.exe
        6⤵
        
        PID:13376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        6⤵
        
        PID:15500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25894.exe
        5⤵
        
        PID:6112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2997.exe
        5⤵
        
        PID:14148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26457.exe
        5⤵
        
        PID:4076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60859.exe
      4⤵
      PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28092.exe
        5⤵
        
        PID:8636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64854.exe
        5⤵
        
        PID:12804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30950.exe
        5⤵
        
        PID:6760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43120.exe
      4⤵
      PID:7972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48471.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14990.exe
      4⤵
      PID:13952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9419.exe
      4⤵
      PID:6580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33011.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33011.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13679.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63792.exe
        5⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9147.exe
        6⤵
        
        PID:7468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4354.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46468.exe
        6⤵
        
        PID:15220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64858.exe
        6⤵
        
        PID:16764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3231.exe
        5⤵
        
        PID:8044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47103.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41680.exe
        5⤵
        
        PID:11976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47599.exe
        5⤵
        
        PID:15856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25494.exe
      4⤵
      PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26169.exe
        5⤵
        
        PID:7428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4354.exe
        5⤵
        
        PID:10364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13736.exe
        5⤵
        
        PID:6428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34374.exe
      4⤵
      PID:7708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42714.exe
      4⤵
      PID:12536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41740.exe
      4⤵
      PID:15516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25338.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25338.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53901.exe
      4⤵
      PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24633.exe
        5⤵
        
        PID:7920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35815.exe
        5⤵
        
        PID:11720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46957.exe
        5⤵
        
        PID:15100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18233.exe
        5⤵
        
        PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10249.exe
      4⤵
      PID:8260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7471.exe
      4⤵
      PID:10968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13125.exe
      4⤵
      PID:12888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10694.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10694.exe
    3⤵
    PID:5372
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5372 -s 632
      4⤵
      Program crash
      PID:9552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59639.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59639.exe
    3⤵
    PID:7780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32703.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32703.exe
    3⤵
    PID:12168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3188.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3188.exe
    3⤵
    PID:2784
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4038.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4038.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21741.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21741.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2444.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60016.exe
        5⤵
        
        PID:3940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4524.exe
        6⤵
        
        PID:1068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22716.exe
        7⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49923.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54115.exe
        7⤵
        
        PID:10264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26793.exe
        6⤵
        
        PID:9540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18713.exe
        6⤵
        
        PID:13980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2277.exe
        6⤵
        
        PID:14444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15318.exe
        5⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53436.exe
        6⤵
        
        PID:10492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48934.exe
        6⤵
        
        PID:2972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52669.exe
        6⤵
        
        PID:17056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23622.exe
        5⤵
        
        PID:8548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1135.exe
        5⤵
        
        PID:12756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20642.exe
        5⤵
        
        PID:16140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55828.exe
      4⤵
      PID:3000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23123.exe
        5⤵
        
        PID:6840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53436.exe
        6⤵
        
        PID:10340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48934.exe
        6⤵
        
        PID:13836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7986.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50442.exe
        5⤵
        
        PID:10036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11727.exe
        5⤵
        
        PID:13480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37740.exe
        5⤵
        
        PID:16672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27517.exe
      4⤵
      PID:6624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57276.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48934.exe
        5⤵
        
        PID:12676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        5⤵
        
        PID:2044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-178.exe
      4⤵
      PID:9568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6777.exe
      4⤵
      PID:13036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9835.exe
      4⤵
      PID:15884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1686.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1686.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25040.exe
      4⤵
      PID:3928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1452.exe
        5⤵
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22716.exe
        6⤵
        
        PID:7556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49923.exe
        6⤵
        
        PID:12088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23126.exe
        6⤵
        
        PID:4820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30419.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58890.exe
        5⤵
        
        PID:9440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18713.exe
        5⤵
        
        PID:13996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38316.exe
        5⤵
        
        PID:11160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5043.exe
      4⤵
      PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2306.exe
        5⤵
        
        PID:10172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5862.exe
        5⤵
        
        PID:13532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29014.exe
        5⤵
        
        PID:1320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41578.exe
      4⤵
      PID:8332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15442.exe
      4⤵
      PID:12508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58307.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19677.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19677.exe
    3⤵
    PID:2612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-376.exe
      4⤵
      PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42809.exe
        5⤵
        
        PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49923.exe
        5⤵
        
        PID:11816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20674.exe
        5⤵
        
        PID:16280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17090.exe
      4⤵
      PID:9112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9577.exe
      4⤵
      PID:12464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52445.exe
      4⤵
      PID:16204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21455.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21455.exe
    3⤵
    PID:6848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62812.exe
      4⤵
      PID:13904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53731.exe
      4⤵
      PID:1472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64282.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64282.exe
    3⤵
    PID:10132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28706.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28706.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:14128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30191.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30191.exe
    3⤵
    PID:60
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61518.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61518.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48848.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48848.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62637.exe
      4⤵
      PID:1552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46896.exe
        5⤵
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57692.exe
        6⤵
        
        PID:7304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49923.exe
        6⤵
        
        PID:11860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52253.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53514.exe
        5⤵
        
        PID:9808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35059.exe
        5⤵
        
        PID:12992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36901.exe
        5⤵
        
        PID:10656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13782.exe
      4⤵
      PID:6644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60348.exe
        5⤵
        
        PID:10760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14460.exe
        5⤵
        
        PID:14976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55469.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2761.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18713.exe
      4⤵
      PID:13988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20834.exe
      4⤵
      PID:16116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17014.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17014.exe
    3⤵
    PID:5268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54688.exe
      4⤵
      PID:10096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5862.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45843.exe
      4⤵
      PID:16632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28777.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28777.exe
    3⤵
    PID:7788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55676.exe
      4⤵
      PID:14616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19346.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19346.exe
    3⤵
    PID:11328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57583.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57583.exe
    3⤵
    PID:15740
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6003.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6003.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe
    3⤵
    PID:5652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50745.exe
      4⤵
      PID:6520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4187.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3269.exe
        5⤵
        
        PID:16068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59683.exe
      4⤵
      PID:8200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3366.exe
      4⤵
      PID:13664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29014.exe
      4⤵
      PID:14408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12447.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12447.exe
    3⤵
    PID:7252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22697.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22697.exe
    3⤵
    PID:10644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58710.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58710.exe
    3⤵
    PID:14532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14204.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14204.exe
    3⤵
    PID:16748
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53789.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53789.exe
  2⤵
  PID:5904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7640.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7640.exe
    3⤵
    PID:7484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49923.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49923.exe
    3⤵
    PID:11796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18092.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18092.exe
    3⤵
    PID:11968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20674.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20674.exe
    3⤵
    PID:16124
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17777.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17777.exe
  2⤵
  PID:7932
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45978.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45978.exe
  2⤵
  PID:4660
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24971.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24971.exe
  2⤵
  PID:15948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 5372 -ip 5372
1⤵
PID:9352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5136 -ip 5136
1⤵
PID:10712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 7600 -ip 7600
1⤵
PID:12888

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10931.exe

Filesize
468KB

MD5
5d38b04436ec63b948505864a8241db8

SHA1
8131c0245d01c8fe95e3aef74d4ce15a1ed1bbf5

SHA256
6ff96fd78c4574048a875fa198381c941c559ddc278e2409b4ed5931c8c9333c

SHA512
f6f60d26c06fec9e63eac8251159f803a9487a7d5486e51157675c12452d8c077a9ee95bc54235549944d52fbfe007704fa735e5e9a62dbd2ca71307c39f6d1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12594.exe

Filesize
468KB

MD5
4f50063ea83d190fc42de30760380f8e

SHA1
407c93d4c7780dc3128a61f30f25288018d456a9

SHA256
5f75d019960b3a56567d14cdc44087e9ef3a439348667f7e167995481643a3b0

SHA512
25ec18ebf3e9af90cefe2ecff38e50140753817b5a4d8fa9b9cb33f557ee99717616554b762d4586bb5f2a25c35279dd444238331b532983fbe6294d4f6655f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14205.exe

Filesize
468KB

MD5
8c47fb7564f7d38a61652d9c543e41a9

SHA1
e7eb0a137deb1bfc24de6f3f2ed7890c60e3acb3

SHA256
8a87a59b6473228c37be22cd89c6874f5f9ec91807bade3c37d06522d698d505

SHA512
818c69df9dc16978adf56fdda14fbe04e3db5d3287254a1ab1046c2651976f69d5802e12e577d451e85337979c623b0040366b029da2b1a64be7e526364b1f98

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15888.exe

Filesize
468KB

MD5
24f9f9a263f13345010b19df2364d90b

SHA1
86384ecbceb26265b5255ec21a4721cbd3eeb86f

SHA256
a400271fdc5b3ac0a1c009edae5c96af698551e9ae6a4add55858e2ec36ab05a

SHA512
47b657362c400f7eca7388430a874059780474779e5526c2941c30cfe274cdefd365755ed685ec9fb84d561d291a7b5499a4a0f4c4fb744e53f74d28aee382b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19437.exe

Filesize
468KB

MD5
a96929eb5ab83a59b9909dd1506c0110

SHA1
27c75a087d3123dc49fc16b020a6db5ff043e002

SHA256
a963d8538244525471f6d81c183873cdee352184d7b1177b30fa76a468ee8580

SHA512
53a020d33e26dbc001d704973c50388376869b66065eb49f8335aa0c6fd1683dde29bb62e64a7c8a16841b8d7b630ee96867c0a88a1ca9a415eca41b4934d9a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21133.exe

Filesize
468KB

MD5
3bb6731fa77a1467477ee297691e8bfb

SHA1
a00c28c742add56d515aabcfc3ce3cf4990cc123

SHA256
8ba1f30cb2b4e180463932b75b7f543f5b780955241790858c8f0e3c3787ef6d

SHA512
01a3025079ace795438caf33cf2ca5d54aac19fdc4f228097a1055f1cd4c0b81a964ae73d6ec65751d23e5f4b26545f9982d55ece95641dff5757f1d07123c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21741.exe

Filesize
468KB

MD5
1c185405773e78bf79f439b3346a471b

SHA1
2e2859c1fbd5cfba5148f7c193e7ade4cb18501e

SHA256
6609d75c977f1f72cfb81866cb44138f78d5c6744693f47f1be9d44d6597540f

SHA512
c1a62cc3a2e8fd3f846e20ecafe896237d7aac13b3b05721aaa6281e9b078c43f35fe609e4364b093313b4165689cddfb8afff9a9e49d036c4c79491f812d93a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21933.exe

Filesize
468KB

MD5
db6c1ee308701ca9edc149c09ecfbe17

SHA1
5d7ccc7b653630470a7c5177690d68518f98a616

SHA256
2047c51841f8ef45cb74d1c5c94c0fca76c3f877cde34be0f4f387dd9656a8ed

SHA512
7b702e916c62043c3ec64c39540efc91bb34aa6d24b20a1aef72ff046116912c1d69be126ad72fdcbe9fcacc96a54bd459535df40cd7c7d331463289a82c10ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23484.exe

Filesize
468KB

MD5
14f07a3c26a2c8ba545f75cd71de3ed8

SHA1
58994ea926a76cd66ffef3861222fe9a0a9c8b4f

SHA256
e3db3bc1a91f164487f989162b28cdbd0ef2a1c0304c65a83b66da6a3ca94abf

SHA512
b1022b83e9d363cfda54f9e5ef681977fa10bbb8b456a509ef58a8f7342ab8840ac1353f20afac8a74866f222b26bbc5cd842a4b0ec2a26d7f496430856b8f85

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33011.exe

Filesize
468KB

MD5
b1ff1586a28e00c0adcc0e1c559d82a6

SHA1
8cbb4658fc386944b780351309331257db94af44

SHA256
38ad9a160345c933cef11c7469d4c775abe70d72d32e73dc63d0647028d9f27c

SHA512
16a62b596ae93469e213fc9c25a0b24848dad263a6ffff2fd6f99822ea6ad5c50253a3a3a565e51ea7796004013728a16680abbee3a030f593a8a84c0ba32b46

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34323.exe

Filesize
468KB

MD5
fc91dfddc244fc37bcf52dc066c1b2f9

SHA1
809057637c2542b8060425ee9c9fe81e913185d9

SHA256
3a279d5e975919f7d8490ce7eee3a5477de1f31d936fd70ab297d848bfe0d8f6

SHA512
cd43758540a02cc56483476199799215fd7ed9513446874e9477475c8361e822ca6fa7f6b64e52579cd7c8588894ca9d76b67cb23acd42381b16ba38c1d48eb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34576.exe

Filesize
468KB

MD5
55734dbab591a82389982ba85f78054b

SHA1
deb4c84ed1d414392ea93bcf4a176bc509ed7a33

SHA256
7b2c39bec2f72ea636ca9856d637a22428e32a1f43909b799cb1d57da802e68b

SHA512
d06e39e927562beae01b382d18201beabc2c9e62bc9cae576630ad9af75fc06ee16142c93a489c6159ce16ee2a1c1c3f77cdbb1ad80d30e2a0058e8e68222a61

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36400.exe

Filesize
468KB

MD5
a53f69ac04c7c1e1b1db0aea0bf8479f

SHA1
172844e0e418292436049de0fb09de9775f1d0bc

SHA256
f1be0add901332aefa639ecc67373c68aa4f9aca9a74eb1f9f39258f7ba14017

SHA512
0819841e83480eaa5375c18d100024cb6bd56c156f86575b6029b98f19287b66c871e07735a599dd16d7a4da457e8e4f0be999e65082330e07099aae11c62721

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37549.exe

Filesize
468KB

MD5
21319203a253681d97b6624fb507f96b

SHA1
d3ff44a464a53fc23501ea709532da07172a5db0

SHA256
2704c9677d5e1176f25522094ee03675db72415de5ec20e56e173888cd000ea3

SHA512
20435401a327bcc3ee56d99f694d49de7deb39565c12ace19a8aaaf9fe5b7e976c25e10266b85bd3cc7a30e20bd817c5f05bedebe4074889a42b0f70349f8a7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38102.exe

Filesize
468KB

MD5
6c1152c8786ee18f77e474d9a736c067

SHA1
eda691aa47c90aad100b0a28cf9d2edc3bfd8c42

SHA256
4686060323520591d6433f19edd70277b867660eec46cd6f7418a8118c281509

SHA512
fb9e54ead53dce548270d3022d8e7380e4caed0b71aae90c5c859c231d641857f3002b2662aafbee46b22549f0d8f10ef99ba11893b797fa6612b685193952f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4038.exe

Filesize
468KB

MD5
13e9bb36669075fa11d749195a217616

SHA1
3c17207555473cf32f4db1b9000132f5dabb9a83

SHA256
19cd8504a6012a20808b02a224348d25a887db7455ae623e7877fb80adf619d8

SHA512
240ebfb270fd74e466ec33715df3e04b605ac0c20c1f8dad91b1568e39ad5cd56fe6be914dd5fd4f6622f999515c9b24a6a4addad2a9355dc6807e03f267bf6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42768.exe

Filesize
468KB

MD5
8589b3b65930a911a4833743446cc35a

SHA1
0bd06110b6bd642c937928868a7fd7db573b2eb7

SHA256
d60328e9b3e79c695bd0fd576fe7ed7801710ac1cf8eabdb10261cb17de39a11

SHA512
ab3f9fd61cac2ab3b74a3c9729c38ae77df72b3f5ad1d716b6a21916bacb01e16b30822d07dc2e5ed233fc4cf33b70c873f628df7ea5281329753b6b444871d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43956.exe

Filesize
468KB

MD5
571f86f0104b949c1bf2cf81aa350d94

SHA1
b6a11ab0612c87631a726bf06f2d509c9da57f75

SHA256
d80f574d5326c475c2da8040bf2a284440b736dc0a3f820e9fa83b6a2bf06455

SHA512
e3cfc3c41c7a2d9606db36f77d36d789545e4f4f7d6c76478b0a7052fb2d88c146d504b5fdcc1d52c211715cd7b254b8cdd9c6d714e80e76b580d2097fc5d482

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45840.exe

Filesize
468KB

MD5
42967a78282a85db5269ba826360c3eb

SHA1
acfc035ca3818f41040e7dd9a0bf4f0f60f68577

SHA256
47835120f08e0566e4789f195a9898ec5b0dc34e8c6e0c4798ee86b906ef2422

SHA512
c1ad82b35867e8793b8770aca75f96b2b1ce14b23212819566db08eaa9c5fdf89202659a0d135d549b2f3b950804cdc1ebbd0d631750ba42c1c37c9adafa1c0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4684.exe

Filesize
468KB

MD5
6b9c7eabacde406a91d75e43723e6a80

SHA1
c0caa67d2b908718a4effbabf2e0f522c820ce7b

SHA256
aa23edeb464696b397b2fde7df519d771cbfaaddf6089d9b5eabe0a502f7f4d5

SHA512
614f64a431e59010ce310f9aa925ef2cc2d21b19f0b41d3311047ce70cb04be8bb61b9ff097052f9ca4be77ea960fde80c3ed426f1d7ac338d13d2ad343815ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe

Filesize
468KB

MD5
73cf74eb741ea011e6033d009eab155e

SHA1
6b774be3c20c189e29251f080d313f55a914f6e3

SHA256
5a3f5bcc42e97095c8b7a8b5a10abde907a6cd65c864571466ce0a6d1d377e4f

SHA512
e15181bd173991685138f7083e202c4c676a2538fbabb2011762c46e84d926a2b156179e7bda42258d5dbb4e57faccf3906a10728f42d5e73bcb5ea581930cee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47867.exe

Filesize
468KB

MD5
24887ce89d0619b1fa7365257b4d0bf4

SHA1
7e246ed15d713d7bba113eaa07d44d689cc68238

SHA256
fc776794d2794b56fb33b6c0192e4e3e581f25b3f5a55736ac43bea5d9e57f65

SHA512
63ec9bce7258162d384e31bcbf3608042e2fab59784f98b3aabc7c6d16832af27ee5daaeaa71f7338cb03e06e32b608a04be2f3d0fd2f1c4a3ef24eac886ee7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48087.exe

Filesize
468KB

MD5
0c3e5a93c34ab74e40d07d0f60da1bb3

SHA1
b6171ba0aea81d1e7330a959cd950469e328e772

SHA256
43f02d6d801cfa0bd1e6bb6ca8f44b7b27e0ef2dc5db64cec7439214d98fa28d

SHA512
173294d4b0879725f932ce822f17681a32c09673b8794e643df46bc20a42082395a3707ffb5129e6a8141e7eed82226c130149ebcd52eb62a7b5ecf6607f8824

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4911.exe

Filesize
468KB

MD5
e57eefd762f136f029dbfcb9ab5018f8

SHA1
220e20c74666de129b94e23d97836d26385614c6

SHA256
a9fbe0ed60856fb82cd6c38e67de158943542ce81d006bb3e1b92348ef9cddfb

SHA512
2f01f30124607fe57e4b51701245e28ffdb43e7c803c7060e0ab7a136469e942f290ec263b144e6934997b32a3931bc6810f2c0f8de6663be12ceeb289743b66

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52612.exe

Filesize
468KB

MD5
c3c2c55155f5a4bec04388fb8c1d4da3

SHA1
7bb0561a1812549366ba2a046ab552c923df820e

SHA256
7aae1853182026ea16085d908f94de4c55d09858cb85afa4401d9c6f8562fc46

SHA512
fb98aae209d0b1a55c7ddeea38c3ff6ab2260bbc16e55fc42a59cb48402024eef7cf63d5d76c5c7fdd078b28ffd8d3cb5c7f46df0327f574663c33da7fef2d1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53997.exe

Filesize
468KB

MD5
c9261df0d563d87007f50df9f01d782d

SHA1
9a59725b26698bc198cabf9350a77a0982c36e46

SHA256
21e70f9851f3b8af0756e027d226fcb5bdca7af470f9d3dac6a9cf3863133974

SHA512
a15cd85dab3462a34e827348494ca49eba145c2da41cc03d86093f01ef7e4b746afa0a4282ceb1e42e6873adf273ad0831df9083747b25ed206203c534b081cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57691.exe

Filesize
468KB

MD5
283c7ec47995842369d2d0c4133586bb

SHA1
c95521bfb75e1043bdab3f06ef828044fd9af3ed

SHA256
b2e9643b19164433501afc44115f26edb5d6e3504c8583fc413997592d4bbc81

SHA512
ca2fe18c003c79b0ca0c0075ad078a03e15df99f29f0bb3cfd304d1f62cd3cedfe721daf179b47deb8065681627934a5b97a3021f62d3feb72e1c59432dd5342

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5839.exe

Filesize
468KB

MD5
bcb9e6479979c8986d09530e6bb2688b

SHA1
9017aaafd344b91caf4e42131915130ff511ec18

SHA256
8971f2b47598961e1bac0fe720aa9ac2522463fda6281bd85ab933429e3ebfe9

SHA512
f07fe819c78dd227ab2907e26c8bd37d96af150c32fb85e495a2b303d8b435ce5c942d0fbe859f0c8237dbe29ef64d98996685db93dca872889641106e8defae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61518.exe

Filesize
468KB

MD5
e6ace30a4c4b00b54c39376ab6f3dbeb

SHA1
adbe51129e0ee4013b80694a4b5fc2e118b2159e

SHA256
a2c5c5c28a287c4f695b068d72ab7e9c0e988948652f7edc70708de7421249ec

SHA512
f3b54418b8ea43bd59fd67c190ac05177c185219ff476a5669088d259a53bf9cbfe0ef604e407240acbe981550fffdd60924ca28122439ca96f369b4ac6ab54d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61822.exe

Filesize
468KB

MD5
9f121cf34d09dda8b603f9ab43b64e2e

SHA1
e9a12ffa68d5ac51b8093b343c6ea9460cb2a8e6

SHA256
a84fb964893ffec90b8057c627be373f32e6ac6aba1016352e27883dad55dff9

SHA512
db036e56c2dd41a9b24d4e152ee0ab4ed13d35ab0b84b9c3bbe20a9a170bdae838f28d243796f7ed3f57c2ccb85638cc6228410422e85dac32d909017b6433eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65108.exe

Filesize
468KB

MD5
3edc8a200d5638701ba7301d27771a61

SHA1
12d2ac8c4ae075ace2c06a6a4f82b50495208b38

SHA256
eb5ed5703a9b5bd66f7d59a9e18d36414e1e9026cda023edb917dfe4fa955e3b

SHA512
cab48db8017b94b7d08374a9aa43efd8de290bd95a358315c877869bc8c44ce76e523dbadb741af6e2e6455aefd16169f6f83a0da75894eae39d0079e7c94a4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-691.exe

Filesize
468KB

MD5
a0d9d5fb2bd7aa48f60034fd74d2ce38

SHA1
2cbb5e3d6a5dc7ee897b3994233eb7d08adf59e5

SHA256
5953ffd1b76f0d5c797d7a560d324c1c25bb8ba51f1889cbbd72342e0f95c71b

SHA512
c7237adac70415ae1f306a3045209d85a4259311eb6d4dffcfe0a9217d6e8070bf11d801a7e995834981df4a9673e228810f40284eafd8edf974e6abea2ef87e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9042.exe

Filesize
468KB

MD5
9f80481353b90801a81d28de0a783224

SHA1
5ec532e097bbc68ea298005f789048f82835156f

SHA256
c42c59745a5182b067ac030fb727788d31cb6239e2349821503de84138d8f999

SHA512
492a04d3508a2c41ae9c1609c91b21fe720ff45081d4a2ee4c1521b2d20962579a077c3687df253c7ed77a9f13db12e2ba38b85caaef796718931a34821e4a77

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9644.exe

Filesize
468KB

MD5
28bd6f65843a7da85fe32e2ad9466b65

SHA1
f2299f3fef269c5e029a7469aa07d3cb02091c26

SHA256
e18ae89c718521ab23e5719809d708475c9d23fcbf7445936790532219fad6e9

SHA512
5164a7bad3aeb25c2857345271a312e140920510d240799819466c31c4575d4da2e779a70a8cd5193debd4ffed158edea5f6cb6178af8d029c0cad05f1bc4328

Download Submit
memory/224-478-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/412-300-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/456-88-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/468-455-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/716-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/780-282-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/856-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/988-159-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1100-377-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1140-274-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1220-142-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1252-89-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1388-252-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1476-343-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1504-477-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1512-396-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1552-535-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1568-197-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1588-87-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1680-199-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1728-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1768-299-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1912-543-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2084-218-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2100-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2120-466-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2152-177-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2240-397-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2260-449-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2304-258-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2320-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2360-479-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2380-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2504-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2548-131-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2564-324-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2588-176-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2612-483-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2692-179-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2724-475-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2728-476-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2836-452-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2844-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2864-96-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3000-450-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3020-395-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3036-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3184-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3224-196-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3348-302-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3396-178-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3420-468-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3508-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3520-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3560-538-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3564-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3648-301-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3656-235-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3692-269-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3716-404-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3804-405-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3828-537-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3888-331-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3928-459-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3940-456-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4016-219-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4256-536-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4260-92-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4264-244-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4308-412-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4388-44-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4400-407-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4408-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4412-45-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4472-539-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4504-265-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4552-224-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4556-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4616-14-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4632-229-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4636-43-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4656-198-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4740-485-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4804-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4808-534-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4872-406-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4876-398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4968-484-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4976-21-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5052-443-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5084-83-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5088-56-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5092-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5104-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5112-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5116-130-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15244-2540-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads