3aff2012b0ae36cb2c4cb0696ec067e926cc97beda983d7a2c73b5395dadb3de

Analysis

max time kernel
120s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 05:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db133bff02ce238823e5c8e2f2792e80N.exe
Size

468KB
MD5

db133bff02ce238823e5c8e2f2792e80
SHA1

e5bc02056f5657fe3d2cbac7765e70cab7f438cc
SHA256

3aff2012b0ae36cb2c4cb0696ec067e926cc97beda983d7a2c73b5395dadb3de
SHA512

ef5a1a633b39c09961547780d9e8a2953865f783f0a3b653d8b514ec8cbd08cb33be3b32d50cd430050618e0202c42f5bd74c798e12758baf13b33df79db21a1
SSDEEP

3072:6NFzogJER05BtgYjPzDjqf8uECntZnpOnmHhUohr8ULMcciWVFEi:6NFoR8BtdPfjqfRpDz8U4ViWV

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3196	Unicorn-49758.exe
2840	Unicorn-41118.exe
440	Unicorn-30489.exe
3680	Unicorn-62446.exe
4148	Unicorn-39980.exe
4596	Unicorn-46110.exe
5088	Unicorn-35481.exe
220	Unicorn-8362.exe
1708	Unicorn-20292.exe
2000	Unicorn-15964.exe
1380	Unicorn-16230.exe
1360	Unicorn-65430.exe
4424	Unicorn-33443.exe
2644	Unicorn-45373.exe
3828	Unicorn-59108.exe
3472	Unicorn-42099.exe
1656	Unicorn-3868.exe
4788	Unicorn-48622.exe
4812	Unicorn-17987.exe
4488	Unicorn-48430.exe
2028	Unicorn-27107.exe
5116	Unicorn-50542.exe
1392	Unicorn-50542.exe
2580	Unicorn-2410.exe
312	Unicorn-43443.exe
848	Unicorn-38844.exe
2224	Unicorn-23577.exe
3084	Unicorn-43178.exe
4364	Unicorn-3379.exe
2560	Unicorn-17984.exe
2212	Unicorn-38844.exe
4172	Unicorn-690.exe
2896	Unicorn-29833.exe
3480	Unicorn-32870.exe
2656	Unicorn-44145.exe
3336	Unicorn-34598.exe
2640	Unicorn-34598.exe
4624	Unicorn-9901.exe
2356	Unicorn-39236.exe
4332	Unicorn-2537.exe
2264	Unicorn-48474.exe
3180	Unicorn-10861.exe
3292	Unicorn-10861.exe
3040	Unicorn-60062.exe
5072	Unicorn-3762.exe
3024	Unicorn-19030.exe
3908	Unicorn-40004.exe
1204	Unicorn-59870.exe
960	Unicorn-40004.exe
2564	Unicorn-40004.exe
3100	Unicorn-59870.exe
1332	Unicorn-35677.exe
1172	Unicorn-53740.exe
2812	Unicorn-31836.exe
672	Unicorn-10476.exe
3352	Unicorn-16076.exe
3068	Unicorn-29811.exe
660	Unicorn-47217.exe
1884	Unicorn-50940.exe
3132	Unicorn-49694.exe
1420	Unicorn-42403.exe
2244	Unicorn-38873.exe
4856	Unicorn-58739.exe
4192	Unicorn-52609.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
12900	8092	WerFault.exe	326
15452	7800	WerFault.exe	316
2060	15032	WerFault.exe	715
20192	4152	Process not Found	1026

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23577.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2089.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40449.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15043.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27164.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38921.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53497.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2553.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49081.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40060.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47565.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17436.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51334.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4595.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8227.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24054.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59562.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63892.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58105.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37422.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26624.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-251.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46714.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34910.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60014.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52069.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12675.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23996.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9637.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12105.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43516.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15780.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46110.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20292.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45875.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46638.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48313.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6211.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54131.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2107.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53010.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54830.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24762.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21859.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37038.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	Process not Found

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Process not Found

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	19288	Process not Found
Token: SeChangeNotifyPrivilege	19288	Process not Found
Token: 33	19288	Process not Found
Token: SeIncBasePriorityPrivilege	19288	Process not Found

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3996	db133bff02ce238823e5c8e2f2792e80N.exe
3196	Unicorn-49758.exe
2840	Unicorn-41118.exe
440	Unicorn-30489.exe
3680	Unicorn-62446.exe
4148	Unicorn-39980.exe
4596	Unicorn-46110.exe
5088	Unicorn-35481.exe
220	Unicorn-8362.exe
2000	Unicorn-15964.exe
1708	Unicorn-20292.exe
1380	Unicorn-16230.exe
1360	Unicorn-65430.exe
3828	Unicorn-59108.exe
2644	Unicorn-45373.exe
4424	Unicorn-33443.exe
3472	Unicorn-42099.exe
1656	Unicorn-3868.exe
4788	Unicorn-48622.exe
4812	Unicorn-17987.exe
4488	Unicorn-48430.exe
1392	Unicorn-50542.exe
2224	Unicorn-23577.exe
3084	Unicorn-43178.exe
848	Unicorn-38844.exe
312	Unicorn-43443.exe
2580	Unicorn-2410.exe
2028	Unicorn-27107.exe
4364	Unicorn-3379.exe
5116	Unicorn-50542.exe
2212	Unicorn-38844.exe
2560	Unicorn-17984.exe
4172	Unicorn-690.exe
2896	Unicorn-29833.exe
3480	Unicorn-32870.exe
2656	Unicorn-44145.exe
3336	Unicorn-34598.exe
2640	Unicorn-34598.exe
4624	Unicorn-9901.exe
2264	Unicorn-48474.exe
2356	Unicorn-39236.exe
4332	Unicorn-2537.exe
3180	Unicorn-10861.exe
3292	Unicorn-10861.exe
3040	Unicorn-60062.exe
5072	Unicorn-3762.exe
3024	Unicorn-19030.exe
1172	Unicorn-53740.exe
672	Unicorn-10476.exe
3908	Unicorn-40004.exe
3352	Unicorn-16076.exe
1204	Unicorn-59870.exe
2564	Unicorn-40004.exe
1332	Unicorn-35677.exe
960	Unicorn-40004.exe
660	Unicorn-47217.exe
2812	Unicorn-31836.exe
1884	Unicorn-50940.exe
3068	Unicorn-29811.exe
3100	Unicorn-59870.exe
3132	Unicorn-49694.exe
1420	Unicorn-42403.exe
2244	Unicorn-38873.exe
4192	Unicorn-52609.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3996 wrote to memory of 3196	3996	db133bff02ce238823e5c8e2f2792e80N.exe	88
PID 3996 wrote to memory of 3196	3996	db133bff02ce238823e5c8e2f2792e80N.exe	88
PID 3996 wrote to memory of 3196	3996	db133bff02ce238823e5c8e2f2792e80N.exe	88
PID 3196 wrote to memory of 2840	3196	Unicorn-49758.exe	89
PID 3196 wrote to memory of 2840	3196	Unicorn-49758.exe	89
PID 3196 wrote to memory of 2840	3196	Unicorn-49758.exe	89
PID 3996 wrote to memory of 440	3996	db133bff02ce238823e5c8e2f2792e80N.exe	90
PID 3996 wrote to memory of 440	3996	db133bff02ce238823e5c8e2f2792e80N.exe	90
PID 3996 wrote to memory of 440	3996	db133bff02ce238823e5c8e2f2792e80N.exe	90
PID 2840 wrote to memory of 3680	2840	Unicorn-41118.exe	91
PID 2840 wrote to memory of 3680	2840	Unicorn-41118.exe	91
PID 2840 wrote to memory of 3680	2840	Unicorn-41118.exe	91
PID 3996 wrote to memory of 4148	3996	db133bff02ce238823e5c8e2f2792e80N.exe	92
PID 3996 wrote to memory of 4148	3996	db133bff02ce238823e5c8e2f2792e80N.exe	92
PID 3996 wrote to memory of 4148	3996	db133bff02ce238823e5c8e2f2792e80N.exe	92
PID 440 wrote to memory of 4596	440	Unicorn-30489.exe	93
PID 440 wrote to memory of 4596	440	Unicorn-30489.exe	93
PID 440 wrote to memory of 4596	440	Unicorn-30489.exe	93
PID 3196 wrote to memory of 5088	3196	Unicorn-49758.exe	94
PID 3196 wrote to memory of 5088	3196	Unicorn-49758.exe	94
PID 3196 wrote to memory of 5088	3196	Unicorn-49758.exe	94
PID 3680 wrote to memory of 220	3680	Unicorn-62446.exe	97
PID 3680 wrote to memory of 220	3680	Unicorn-62446.exe	97
PID 3680 wrote to memory of 220	3680	Unicorn-62446.exe	97
PID 2840 wrote to memory of 1708	2840	Unicorn-41118.exe	98
PID 2840 wrote to memory of 1708	2840	Unicorn-41118.exe	98
PID 2840 wrote to memory of 1708	2840	Unicorn-41118.exe	98
PID 3996 wrote to memory of 2000	3996	db133bff02ce238823e5c8e2f2792e80N.exe	99
PID 3996 wrote to memory of 2000	3996	db133bff02ce238823e5c8e2f2792e80N.exe	99
PID 3996 wrote to memory of 2000	3996	db133bff02ce238823e5c8e2f2792e80N.exe	99
PID 4148 wrote to memory of 1380	4148	Unicorn-39980.exe	100
PID 4148 wrote to memory of 1380	4148	Unicorn-39980.exe	100
PID 4148 wrote to memory of 1380	4148	Unicorn-39980.exe	100
PID 4596 wrote to memory of 1360	4596	Unicorn-46110.exe	101
PID 4596 wrote to memory of 1360	4596	Unicorn-46110.exe	101
PID 4596 wrote to memory of 1360	4596	Unicorn-46110.exe	101
PID 5088 wrote to memory of 4424	5088	Unicorn-35481.exe	103
PID 5088 wrote to memory of 4424	5088	Unicorn-35481.exe	103
PID 5088 wrote to memory of 4424	5088	Unicorn-35481.exe	103
PID 3196 wrote to memory of 3828	3196	Unicorn-49758.exe	104
PID 3196 wrote to memory of 3828	3196	Unicorn-49758.exe	104
PID 3196 wrote to memory of 3828	3196	Unicorn-49758.exe	104
PID 440 wrote to memory of 2644	440	Unicorn-30489.exe	102
PID 440 wrote to memory of 2644	440	Unicorn-30489.exe	102
PID 440 wrote to memory of 2644	440	Unicorn-30489.exe	102
PID 220 wrote to memory of 3472	220	Unicorn-8362.exe	107
PID 220 wrote to memory of 3472	220	Unicorn-8362.exe	107
PID 220 wrote to memory of 3472	220	Unicorn-8362.exe	107
PID 3680 wrote to memory of 1656	3680	Unicorn-62446.exe	108
PID 3680 wrote to memory of 1656	3680	Unicorn-62446.exe	108
PID 3680 wrote to memory of 1656	3680	Unicorn-62446.exe	108
PID 1708 wrote to memory of 4788	1708	Unicorn-20292.exe	109
PID 1708 wrote to memory of 4788	1708	Unicorn-20292.exe	109
PID 1708 wrote to memory of 4788	1708	Unicorn-20292.exe	109
PID 2840 wrote to memory of 4812	2840	Unicorn-41118.exe	110
PID 2840 wrote to memory of 4812	2840	Unicorn-41118.exe	110
PID 2840 wrote to memory of 4812	2840	Unicorn-41118.exe	110
PID 1380 wrote to memory of 4488	1380	Unicorn-16230.exe	111
PID 1380 wrote to memory of 4488	1380	Unicorn-16230.exe	111
PID 1380 wrote to memory of 4488	1380	Unicorn-16230.exe	111
PID 2644 wrote to memory of 2028	2644	Unicorn-45373.exe	112
PID 2644 wrote to memory of 2028	2644	Unicorn-45373.exe	112
PID 2644 wrote to memory of 2028	2644	Unicorn-45373.exe	112
PID 2000 wrote to memory of 5116	2000	Unicorn-15964.exe	113

C:\Users\Admin\AppData\Local\Temp\db133bff02ce238823e5c8e2f2792e80N.exe
"C:\Users\Admin\AppData\Local\Temp\db133bff02ce238823e5c8e2f2792e80N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49758.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49758.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41118.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41118.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62446.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8362.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42099.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-690.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49694.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12138.exe
        9⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23862.exe
        10⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57126.exe
        11⤵
        
        PID:9480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exe
        11⤵
        
        PID:16464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25722.exe
        11⤵
        
        PID:13308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38796.exe
        10⤵
        
        PID:10832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26624.exe
        10⤵
        
        PID:14440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31003.exe
        10⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8604.exe
        9⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
        9⤵
        
        PID:13416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-212.exe
        9⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24068.exe
        8⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49170.exe
        9⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52438.exe
        10⤵
        
        PID:15752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
        9⤵
        
        PID:13424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34229.exe
        9⤵
        
        PID:15864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62905.exe
        8⤵
        
        PID:7612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60014.exe
        9⤵
        
        PID:13172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23356.exe
        9⤵
        
        PID:14504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49578.exe
        8⤵
        
        PID:11988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33611.exe
        8⤵
        
        PID:16828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38873.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12522.exe
        8⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23862.exe
        9⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10613.exe
        10⤵
        
        PID:9916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17476.exe
        10⤵
        
        PID:14364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27074.exe
        10⤵
        
        PID:17192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32931.exe
        9⤵
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe
        9⤵
        
        PID:16388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31733.exe
        9⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8604.exe
        8⤵
        
        PID:7452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22576.exe
        9⤵
        
        PID:13568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2017.exe
        8⤵
        
        PID:11252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58433.exe
        8⤵
        
        PID:7920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45204.exe
        7⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42206.exe
        8⤵
        
        PID:1140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45870.exe
        9⤵
        
        PID:9632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51218.exe
        9⤵
        
        PID:14288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36307.exe
        9⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32931.exe
        8⤵
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe
        8⤵
        
        PID:16396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25293.exe
        8⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34261.exe
        7⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
        8⤵
        
        PID:11348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47565.exe
        8⤵
        
        PID:17140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8507.exe
        7⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41964.exe
        7⤵
        
        PID:17048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2637.exe
        7⤵
        
        PID:17288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55987.exe
        7⤵
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29833.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42403.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52979.exe
        8⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49170.exe
        9⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54830.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:13888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27601.exe
        10⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53884.exe
        9⤵
        
        PID:13100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29226.exe
        9⤵
        
        PID:17268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25331.exe
        9⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49170.exe
        8⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
        8⤵
        
        PID:12908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60545.exe
        8⤵
        
        PID:17280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31468.exe
        7⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49523.exe
        8⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21366.exe
        9⤵
        
        PID:9780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55929.exe
        9⤵
        
        PID:15512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26770.exe
        9⤵
        
        PID:408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18324.exe
        8⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14498.exe
        9⤵
        
        PID:15604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1803.exe
        9⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45645.exe
        8⤵
        
        PID:14760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35713.exe
        7⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
        8⤵
        
        PID:11316
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7800 -s 628
        8⤵
        Program crash
        
        PID:15452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48618.exe
        7⤵
        
        PID:10668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10368.exe
        7⤵
        
        PID:17200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10460.exe
        7⤵
        
        PID:15904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14941.exe
        7⤵
        
        PID:14572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52609.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61650.exe
        7⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35870.exe
        8⤵
        
        PID:8304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45910.exe
        9⤵
        
        PID:16136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58261.exe
        9⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18627.exe
        8⤵
        
        PID:12836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16395.exe
        8⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58105.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30451.exe
        8⤵
        
        PID:15040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37350.exe
        8⤵
        
        PID:16528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9884.exe
        7⤵
        
        PID:14104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43524.exe
        7⤵
        
        PID:17404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59045.exe
        6⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62398.exe
        7⤵
        
        PID:9792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34004.exe
        7⤵
        
        PID:13952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34931.exe
        6⤵
        
        PID:9712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27164.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30406.exe
        6⤵
        
        PID:16564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22106.exe
        6⤵
        
        PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3868.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32870.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10773.exe
        7⤵
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51334.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7717.exe
        9⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
        10⤵
        
        PID:11076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16869.exe
        11⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12889.exe
        10⤵
        
        PID:13676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28442.exe
        9⤵
        
        PID:13560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23897.exe
        8⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52438.exe
        9⤵
        
        PID:15032
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15032 -s 472
        10⤵
        Program crash
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26608.exe
        8⤵
        
        PID:10376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7129.exe
        8⤵
        
        PID:14548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32921.exe
        7⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24054.exe
        8⤵
        
        PID:7684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60014.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24700.exe
        9⤵
        
        PID:17288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37981.exe
        9⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62533.exe
        8⤵
        
        PID:10084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28928.exe
        8⤵
        
        PID:16528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43108.exe
        7⤵
        
        PID:8736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46003.exe
        8⤵
        
        PID:13132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2521.exe
        8⤵
        
        PID:16784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19098.exe
        8⤵
        
        PID:17404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52650.exe
        7⤵
        
        PID:13236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50820.exe
        7⤵
        
        PID:16916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65490.exe
        6⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52403.exe
        7⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63114.exe
        8⤵
        
        PID:8720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62628.exe
        8⤵
        
        PID:13264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11353.exe
        8⤵
        
        PID:16652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15043.exe
        7⤵
        
        PID:9468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35723.exe
        7⤵
        
        PID:15456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36028.exe
        7⤵
        
        PID:16684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40752.exe
        7⤵
        
        PID:1384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46657.exe
        6⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25123.exe
        7⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24566.exe
        8⤵
        
        PID:13552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6740.exe
        8⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8347.exe
        8⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30929.exe
        7⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28928.exe
        7⤵
        
        PID:16564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6736.exe
        7⤵
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59362.exe
        6⤵
        
        PID:8620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45910.exe
        7⤵
        
        PID:15056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51738.exe
        7⤵
        
        PID:16208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43985.exe
        6⤵
        
        PID:13140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51690.exe
        6⤵
        
        PID:16720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58739.exe
        6⤵
        Executes dropped EXE
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37145.exe
        7⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19446.exe
        8⤵
        
        PID:8500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24181.exe
        9⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20843.exe
        8⤵
        
        PID:15216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12787.exe
        8⤵
        
        PID:12316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6704.exe
        7⤵
        
        PID:8400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62925.exe
        7⤵
        
        PID:13764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1019.exe
        7⤵
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32921.exe
        6⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32222.exe
        7⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
        8⤵
        
        PID:11064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12889.exe
        8⤵
        
        PID:16240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55517.exe
        7⤵
        
        PID:9344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28928.exe
        7⤵
        
        PID:16620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25331.exe
        7⤵
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19755.exe
        6⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
        7⤵
        
        PID:11180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24378.exe
        7⤵
        
        PID:1256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33040.exe
        6⤵
        
        PID:13400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2148.exe
        5⤵
        
        PID:1560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37145.exe
        6⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62123.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20259.exe
        8⤵
        
        PID:14608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30740.exe
        7⤵
        
        PID:13880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48313.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6241.exe
        6⤵
        
        PID:14072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2632.exe
        5⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18787.exe
        6⤵
        
        PID:8824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64653.exe
        6⤵
        
        PID:13160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43362.exe
        6⤵
        
        PID:17240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44884.exe
        6⤵
        
        PID:17124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38769.exe
        5⤵
        
        PID:9280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47539.exe
        6⤵
        
        PID:14144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18556.exe
        6⤵
        
        PID:3668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18050.exe
        6⤵
        
        PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1749.exe
        5⤵
        
        PID:14160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39819.exe
        5⤵
        
        PID:16216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20292.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48622.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34598.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50846.exe
        7⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45470.exe
        8⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7717.exe
        9⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19668.exe
        10⤵
        
        PID:10340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14403.exe
        10⤵
        
        PID:15580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9194.exe
        10⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26876.exe
        9⤵
        
        PID:9488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45156.exe
        9⤵
        
        PID:14944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45268.exe
        9⤵
        
        PID:12308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15043.exe
        8⤵
        
        PID:9452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52069.exe
        8⤵
        
        PID:13364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38921.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32819.exe
        8⤵
        
        PID:16524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34649.exe
        7⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24054.exe
        8⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61675.exe
        9⤵
        
        PID:14804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55517.exe
        8⤵
        
        PID:9428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28928.exe
        8⤵
        
        PID:16644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-251.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53497.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37550.exe
        8⤵
        
        PID:14816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52122.exe
        8⤵
        
        PID:14628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52458.exe
        7⤵
        
        PID:12188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8827.exe
        7⤵
        
        PID:16768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22620.exe
        6⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12714.exe
        7⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10981.exe
        8⤵
        
        PID:7656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41108.exe
        9⤵
        
        PID:13024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45753.exe
        9⤵
        
        PID:16904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56897.exe
        9⤵
        
        PID:17008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13532.exe
        8⤵
        
        PID:11932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17163.exe
        8⤵
        
        PID:16768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48292.exe
        7⤵
        
        PID:9540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52069.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61780.exe
        7⤵
        
        PID:16084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40684.exe
        6⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18294.exe
        7⤵
        
        PID:8412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37550.exe
        8⤵
        
        PID:14876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8265.exe
        7⤵
        
        PID:12348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28835.exe
        7⤵
        
        PID:10768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-642.exe
        7⤵
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10348.exe
        6⤵
        
        PID:9936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28411.exe
        6⤵
        
        PID:14352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14371.exe
        6⤵
        
        PID:956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39236.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23300.exe
        6⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34038.exe
        7⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43862.exe
        8⤵
        
        PID:9748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43516.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10841.exe
        7⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13360.exe
        7⤵
        
        PID:14912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28355.exe
        7⤵
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37633.exe
        6⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61099.exe
        7⤵
        
        PID:14644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10112.exe
        7⤵
        
        PID:16572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32858.exe
        6⤵
        
        PID:10784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58500.exe
        6⤵
        
        PID:16956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44794.exe
        6⤵
        
        PID:7308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44524.exe
        5⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13866.exe
        6⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19446.exe
        7⤵
        
        PID:8508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37180.exe
        7⤵
        
        PID:15188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43741.exe
        7⤵
        
        PID:4472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58506.exe
        6⤵
        
        PID:8276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12291.exe
        6⤵
        
        PID:14984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4043.exe
        6⤵
        
        PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3980.exe
        5⤵
        
        PID:6312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-426.exe
        6⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48107.exe
        7⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exe
        7⤵
        
        PID:14796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32930.exe
        7⤵
        
        PID:2836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55517.exe
        6⤵
        
        PID:9804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36604.exe
        6⤵
        
        PID:17224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7635.exe
        5⤵
        
        PID:8700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10044.exe
        5⤵
        
        PID:11744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3685.exe
        5⤵
        
        PID:16408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38883.exe
        5⤵
        
        PID:6216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17987.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34598.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27302.exe
        6⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52787.exe
        7⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23862.exe
        8⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
        9⤵
        
        PID:11056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12889.exe
        9⤵
        
        PID:15588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38796.exe
        8⤵
        
        PID:10912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9219.exe
        8⤵
        
        PID:16428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49362.exe
        7⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58966.exe
        8⤵
        
        PID:13936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27601.exe
        8⤵
        
        PID:17160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27459.exe
        7⤵
        
        PID:11788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11820.exe
        7⤵
        
        PID:17392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48683.exe
        7⤵
        
        PID:2456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17436.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34910.exe
        7⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12074.exe
        8⤵
        
        PID:11720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24700.exe
        8⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49271.exe
        8⤵
        
        PID:1244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61689.exe
        7⤵
        
        PID:11132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17163.exe
        7⤵
        
        PID:6376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54841.exe
        6⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36771.exe
        7⤵
        
        PID:11520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8857.exe
        7⤵
        
        PID:14956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59661.exe
        6⤵
        
        PID:12824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-763.exe
        6⤵
        
        PID:16496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25293.exe
        6⤵
        
        PID:3560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30980.exe
        5⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50706.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4853.exe
        7⤵
        
        PID:10824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52173.exe
        7⤵
        
        PID:15676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42644.exe
        7⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47266.exe
        6⤵
        
        PID:10072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23824.exe
        6⤵
        
        PID:14504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46714.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40684.exe
        5⤵
        
        PID:6540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27318.exe
        6⤵
        
        PID:8224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-938.exe
        7⤵
        
        PID:12876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39956.exe
        6⤵
        
        PID:13188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45945.exe
        6⤵
        
        PID:3288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36778.exe
        5⤵
        
        PID:8868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1219.exe
        5⤵
        
        PID:14148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43324.exe
        5⤵
        
        PID:16824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2537.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42678.exe
        5⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44510.exe
        6⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29155.exe
        7⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8092 -s 640
        8⤵
        Program crash
        
        PID:12900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10844.exe
        7⤵
        
        PID:11572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28928.exe
        7⤵
        
        PID:16652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55745.exe
        7⤵
        
        PID:16448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63389.exe
        6⤵
        
        PID:8584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58406.exe
        7⤵
        
        PID:15904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44276.exe
        6⤵
        
        PID:15596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41821.exe
        6⤵
        
        PID:6172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36185.exe
        5⤵
        
        PID:6576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54422.exe
        6⤵
        
        PID:9580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13533.exe
        7⤵
        
        PID:16072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55052.exe
        7⤵
        
        PID:13032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32468.exe
        6⤵
        
        PID:12708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4483.exe
        5⤵
        
        PID:9976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6698.exe
        6⤵
        
        PID:13576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52298.exe
        6⤵
        
        PID:16528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15587.exe
        6⤵
        
        PID:16712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5281.exe
        5⤵
        
        PID:13548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37434.exe
        5⤵
        
        PID:11768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33555.exe
      4⤵
      PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13866.exe
        5⤵
        
        PID:6268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34910.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2837.exe
        7⤵
        
        PID:13072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12105.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61300.exe
        6⤵
        
        PID:17120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46050.exe
        6⤵
        
        PID:14796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41483.exe
        6⤵
        
        PID:17204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7364.exe
        5⤵
        
        PID:4576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58966.exe
        6⤵
        
        PID:13960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53796.exe
        5⤵
        
        PID:13348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49259.exe
        5⤵
        
        PID:456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52786.exe
      4⤵
      PID:6340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8293.exe
        5⤵
        
        PID:7724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30318.exe
        6⤵
        
        PID:9952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44877.exe
        6⤵
        
        PID:15164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54844.exe
        5⤵
        
        PID:12984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9324.exe
        5⤵
        
        PID:16976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57750.exe
      4⤵
      PID:8844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59978.exe
        5⤵
        
        PID:15536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46331.exe
      4⤵
      PID:9928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65237.exe
      4⤵
      PID:8092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49364.exe
      4⤵
      PID:16824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35481.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35481.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33443.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2410.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32516.exe
        6⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39907.exe
        7⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48558.exe
        8⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60974.exe
        9⤵
        
        PID:12976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18556.exe
        9⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51195.exe
        9⤵
        
        PID:16176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14484.exe
        8⤵
        
        PID:11224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28928.exe
        8⤵
        
        PID:16604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57620.exe
        8⤵
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15043.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52069.exe
        7⤵
        
        PID:13656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29315.exe
        7⤵
        
        PID:17288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48682.exe
        6⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22627.exe
        7⤵
        
        PID:9592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55929.exe
        7⤵
        
        PID:15520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51180.exe
        7⤵
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21776.exe
        6⤵
        
        PID:9628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59562.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48771.exe
        6⤵
        
        PID:1048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40004.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45750.exe
        6⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23862.exe
        7⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37038.exe
        8⤵
        
        PID:10060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43132.exe
        8⤵
        
        PID:13932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
        8⤵
        
        PID:15828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16987.exe
        8⤵
        
        PID:14572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47850.exe
        7⤵
        
        PID:11600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26128.exe
        7⤵
        
        PID:16628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21058.exe
        7⤵
        
        PID:17024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8604.exe
        6⤵
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37550.exe
        7⤵
        
        PID:14836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2017.exe
        6⤵
        
        PID:12392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51396.exe
        6⤵
        
        PID:16572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39812.exe
        5⤵
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23862.exe
        6⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9186.exe
        7⤵
        
        PID:9240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exe
        7⤵
        
        PID:14896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38796.exe
        6⤵
        
        PID:10840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9219.exe
        6⤵
        
        PID:14576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57044.exe
        6⤵
        
        PID:6320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3425.exe
        5⤵
        
        PID:7748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34270.exe
        6⤵
        
        PID:14008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24659.exe
        5⤵
        
        PID:11812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2089.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27526.exe
        5⤵
        
        PID:16912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38844.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59870.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55070.exe
        6⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
        7⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51822.exe
        8⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13724.exe
        8⤵
        
        PID:11800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49780.exe
        8⤵
        
        PID:16992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29948.exe
        7⤵
        
        PID:9116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4595.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-827.exe
        7⤵
        
        PID:6736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35796.exe
        6⤵
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4453.exe
        7⤵
        
        PID:8716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41130.exe
        7⤵
        
        PID:16048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61789.exe
        7⤵
        
        PID:12304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46498.exe
        6⤵
        
        PID:10700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63108.exe
        6⤵
        
        PID:15704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17316.exe
        6⤵
        
        PID:384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50197.exe
        5⤵
        
        PID:6056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32030.exe
        6⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
        7⤵
        
        PID:11048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exe
        7⤵
        
        PID:16412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45748.exe
        7⤵
        
        PID:16868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2178.exe
        7⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38796.exe
        6⤵
        
        PID:8544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26624.exe
        6⤵
        
        PID:14928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22339.exe
        5⤵
        
        PID:7264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62806.exe
        6⤵
        
        PID:14252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51037.exe
        6⤵
        
        PID:14752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32066.exe
        6⤵
        
        PID:16976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-76.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-76.exe
        5⤵
        
        PID:11728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63892.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26988.exe
        5⤵
        
        PID:3700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47217.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4525.exe
        5⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29952.exe
        6⤵
        
        PID:9164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24685.exe
        6⤵
        
        PID:13216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37384.exe
        6⤵
        
        PID:8960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe
        5⤵
        
        PID:7836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3139.exe
        5⤵
        
        PID:3684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19033.exe
        5⤵
        
        PID:16588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50565.exe
        5⤵
        
        PID:572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45677.exe
      4⤵
      PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47214.exe
        5⤵
        
        PID:7284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4453.exe
        6⤵
        
        PID:8676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41130.exe
        6⤵
        
        PID:16064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17163.exe
        6⤵
        
        PID:3236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8153.exe
        5⤵
        
        PID:10008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40449.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12516.exe
        5⤵
        
        PID:16860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60105.exe
      4⤵
      PID:8004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27934.exe
        5⤵
        
        PID:15416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61283.exe
        5⤵
        
        PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56557.exe
      4⤵
      PID:12132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9637.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22523.exe
      4⤵
      PID:17024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20385.exe
      4⤵
      PID:2388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59108.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59108.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50542.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59870.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29798.exe
        6⤵
        
        PID:228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48366.exe
        7⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14941.exe
        8⤵
        
        PID:9896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44877.exe
        8⤵
        
        PID:14752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38796.exe
        7⤵
        
        PID:10780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26624.exe
        7⤵
        
        PID:14384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49259.exe
        7⤵
        
        PID:16452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50514.exe
        6⤵
        
        PID:8188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
        7⤵
        
        PID:11284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47565.exe
        7⤵
        
        PID:17164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27952.exe
        6⤵
        
        PID:11704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55645.exe
        6⤵
        
        PID:16936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32131.exe
        5⤵
        
        PID:6856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35699.exe
        6⤵
        
        PID:8564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21419.exe
        6⤵
        
        PID:14048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16603.exe
        6⤵
        
        PID:16956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13328.exe
        5⤵
        
        PID:10716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46572.exe
        5⤵
        
        PID:15664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59715.exe
        5⤵
        
        PID:3096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4525.exe
        5⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55574.exe
        6⤵
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14949.exe
        7⤵
        
        PID:11644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47565.exe
        7⤵
        
        PID:16912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33698.exe
        7⤵
        
        PID:3584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38796.exe
        6⤵
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9219.exe
        6⤵
        
        PID:16448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49259.exe
        6⤵
        
        PID:2268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49170.exe
        5⤵
        
        PID:7856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
        6⤵
        
        PID:9996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47565.exe
        6⤵
        
        PID:16904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24762.exe
        6⤵
        
        PID:2760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43713.exe
        5⤵
        
        PID:11220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31333.exe
        5⤵
        
        PID:17100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2107.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17892.exe
        5⤵
        
        PID:6908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37997.exe
      4⤵
      PID:6848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18294.exe
        5⤵
        
        PID:8464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21419.exe
        5⤵
        
        PID:13624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34004.exe
        5⤵
        
        PID:6012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44924.exe
      4⤵
      PID:10748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63638.exe
      4⤵
      PID:15692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6211.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43178.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43178.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10861.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44406.exe
        5⤵
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6549.exe
        6⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24054.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12837.exe
        8⤵
        
        PID:13532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62533.exe
        7⤵
        
        PID:1164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28928.exe
        7⤵
        
        PID:16612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6020.exe
        6⤵
        
        PID:8612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
        7⤵
        
        PID:11088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12889.exe
        7⤵
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37113.exe
        7⤵
        
        PID:8992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        6⤵
        
        PID:12080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17772.exe
        6⤵
        
        PID:16864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43524.exe
        6⤵
        
        PID:17200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52029.exe
        5⤵
        
        PID:6652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38417.exe
        6⤵
        
        PID:8760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
        7⤵
        
        PID:11340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47565.exe
        7⤵
        
        PID:17156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41483.exe
        7⤵
        
        PID:5044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
        6⤵
        
        PID:13540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42747.exe
        7⤵
        
        PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11587.exe
        5⤵
        
        PID:8604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
        6⤵
        
        PID:11332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47565.exe
        6⤵
        
        PID:17112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39033.exe
        6⤵
        
        PID:16960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56485.exe
        5⤵
        
        PID:12100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9107.exe
        5⤵
        
        PID:16872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28105.exe
      4⤵
      PID:5864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
        5⤵
        
        PID:6892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28278.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33118.exe
        7⤵
        
        PID:11824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61689.exe
        6⤵
        
        PID:11812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10860.exe
        6⤵
        
        PID:8024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8227.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7556.exe
        5⤵
        
        PID:9208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25334.exe
        6⤵
        
        PID:12352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25297.exe
        6⤵
        
        PID:15192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53796.exe
        5⤵
        
        PID:13324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19817.exe
        5⤵
        
        PID:17392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1208.exe
      4⤵
      PID:6408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20982.exe
        5⤵
        
        PID:9516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37180.exe
        5⤵
        
        PID:15168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62228.exe
      4⤵
      PID:9228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7289.exe
      4⤵
      PID:14068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7363.exe
      4⤵
      PID:6976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50940.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50940.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29606.exe
      4⤵
      PID:5192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38105.exe
      4⤵
      PID:7156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4453.exe
        5⤵
        
        PID:8684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61099.exe
        6⤵
        
        PID:14664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52490.exe
        6⤵
        
        PID:16408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28994.exe
        6⤵
        
        PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40060.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62577.exe
        5⤵
        
        PID:14580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65219.exe
        5⤵
        
        PID:6352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21888.exe
      4⤵
      PID:9988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60621.exe
      4⤵
      PID:13768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61012.exe
      4⤵
      PID:16652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20476.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20476.exe
    3⤵
    PID:5288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23862.exe
      4⤵
      PID:7212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52630.exe
        5⤵
        
        PID:15084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7419.exe
        5⤵
        
        PID:17400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38796.exe
      4⤵
      PID:10796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26624.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42978.exe
      4⤵
      PID:16540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20069.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20069.exe
    3⤵
    PID:7232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61675.exe
      4⤵
      PID:14996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3467.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3467.exe
    3⤵
    PID:11880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24873.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24873.exe
    3⤵
    PID:17236
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30489.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30489.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46110.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46110.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65430.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43443.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3762.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47395.exe
        7⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55475.exe
        8⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38417.exe
        9⤵
        
        PID:8768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
        10⤵
        
        PID:11324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47565.exe
        10⤵
        
        PID:16928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-642.exe
        10⤵
        
        PID:15176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9779.exe
        9⤵
        
        PID:12052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42277.exe
        9⤵
        
        PID:16760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59201.exe
        9⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41136.exe
        9⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62237.exe
        8⤵
        
        PID:8692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
        9⤵
        
        PID:10708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47565.exe
        9⤵
        
        PID:17036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
        8⤵
        
        PID:13580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-955.exe
        8⤵
        
        PID:16528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40176.exe
        8⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21385.exe
        7⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21859.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49469.exe
        9⤵
        
        PID:12992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41707.exe
        10⤵
        
        PID:17300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3459.exe
        9⤵
        
        PID:17156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16210.exe
        9⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35841.exe
        8⤵
        
        PID:13184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23302.exe
        8⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12756.exe
        7⤵
        
        PID:10736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63108.exe
        7⤵
        
        PID:15728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15780.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26844.exe
        6⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23862.exe
        7⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37422.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43516.exe
        8⤵
        
        PID:12488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18324.exe
        7⤵
        
        PID:10132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21035.exe
        7⤵
        
        PID:15072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22339.exe
        6⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52054.exe
        7⤵
        
        PID:14780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15827.exe
        6⤵
        
        PID:12808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18161.exe
        6⤵
        
        PID:16968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31836.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5101.exe
        6⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23862.exe
        7⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23411.exe
        8⤵
        
        PID:10068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12889.exe
        8⤵
        
        PID:15908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38796.exe
        7⤵
        
        PID:10892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9219.exe
        7⤵
        
        PID:16420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8604.exe
        6⤵
        
        PID:7444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41706.exe
        6⤵
        
        PID:13120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37997.exe
        5⤵
        
        PID:6872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38003.exe
        6⤵
        
        PID:8264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24217.exe
        6⤵
        
        PID:14056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62660.exe
        6⤵
        
        PID:16684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23845.exe
        6⤵
        
        PID:16548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21392.exe
        5⤵
        
        PID:10192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13220.exe
        5⤵
        
        PID:12652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38844.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38572.exe
        5⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20982.exe
        6⤵
        
        PID:9524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55821.exe
        6⤵
        
        PID:14220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43597.exe
        5⤵
        
        PID:9756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63497.exe
        5⤵
        
        PID:13612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53740.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47971.exe
        5⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46046.exe
        6⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42798.exe
        7⤵
        
        PID:8872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56397.exe
        7⤵
        
        PID:11968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62577.exe
        7⤵
        
        PID:17284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56285.exe
        6⤵
        
        PID:9960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54756.exe
        6⤵
        
        PID:13316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28484.exe
        5⤵
        
        PID:7048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48558.exe
        6⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62038.exe
        7⤵
        
        PID:14404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29011.exe
        7⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55434.exe
        6⤵
        
        PID:9912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28928.exe
        6⤵
        
        PID:16512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34939.exe
        5⤵
        
        PID:8656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3429.exe
        6⤵
        
        PID:14704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51956.exe
        5⤵
        
        PID:13948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29331.exe
      4⤵
      PID:6864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3498.exe
        5⤵
        
        PID:8012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61099.exe
        6⤵
        
        PID:14660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59589.exe
        6⤵
        
        PID:12216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23864.exe
        6⤵
        
        PID:9700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13532.exe
        5⤵
        
        PID:11924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58388.exe
        5⤵
        
        PID:608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59709.exe
      4⤵
      PID:8280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13379.exe
      4⤵
      PID:15176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45373.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45373.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27107.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10861.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11733.exe
        6⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6549.exe
        7⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37235.exe
        8⤵
        
        PID:8864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20843.exe
        8⤵
        
        PID:15224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6891.exe
        7⤵
        
        PID:10688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6236.exe
        7⤵
        
        PID:15716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12780.exe
        7⤵
        
        PID:1792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43668.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54422.exe
        7⤵
        
        PID:9676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11721.exe
        7⤵
        
        PID:14300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4588.exe
        6⤵
        
        PID:10756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63108.exe
        6⤵
        
        PID:15736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26844.exe
        5⤵
        
        PID:5996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64110.exe
        6⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27614.exe
        7⤵
        
        PID:8492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20067.exe
        8⤵
        
        PID:15012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12675.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45268.exe
        7⤵
        
        PID:12664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41292.exe
        6⤵
        
        PID:10228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23605.exe
        7⤵
        
        PID:6164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-760.exe
        6⤵
        
        PID:13360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24755.exe
        6⤵
        
        PID:1368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1784.exe
        5⤵
        
        PID:6452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20982.exe
        6⤵
        
        PID:9600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55929.exe
        6⤵
        
        PID:15504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61229.exe
        6⤵
        
        PID:16584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13036.exe
        5⤵
        
        PID:9348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10560.exe
        5⤵
        
        PID:14904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29846.exe
        5⤵
        
        PID:14920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40004.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4525.exe
        5⤵
        
        PID:6072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23862.exe
        6⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5813.exe
        7⤵
        
        PID:10048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43694.exe
        8⤵
        
        PID:14652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59589.exe
        8⤵
        
        PID:12304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22987.exe
        8⤵
        
        PID:10332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-580.exe
        7⤵
        
        PID:16284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38796.exe
        6⤵
        
        PID:1672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26624.exe
        6⤵
        
        PID:7920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54868.exe
        6⤵
        
        PID:4048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8604.exe
        5⤵
        
        PID:1352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26590.exe
        6⤵
        
        PID:15096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1940.exe
        6⤵
        
        PID:2556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43713.exe
        5⤵
        
        PID:12032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42277.exe
        5⤵
        
        PID:16812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55738.exe
        5⤵
        
        PID:17052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37997.exe
      4⤵
      PID:6880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3498.exe
        5⤵
        
        PID:8200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
        6⤵
        
        PID:11292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47565.exe
        6⤵
        
        PID:17172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13532.exe
        5⤵
        
        PID:11872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49259.exe
        5⤵
        
        PID:3360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18299.exe
      4⤵
      PID:8408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34460.exe
      4⤵
      PID:12784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35035.exe
      4⤵
      PID:2892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7555.exe
      4⤵
      PID:6520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3379.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3379.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57021.exe
      4⤵
      PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39907.exe
        5⤵
        
        PID:6436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62315.exe
        6⤵
        
        PID:8996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37756.exe
        6⤵
        
        PID:14556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21403.exe
        6⤵
        
        PID:2884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23996.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57252.exe
        5⤵
        
        PID:13096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15686.exe
      4⤵
      PID:6616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50582.exe
        5⤵
        
        PID:8788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48893.exe
        5⤵
        
        PID:13288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22208.exe
        5⤵
        
        PID:17200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-258.exe
        5⤵
        
        PID:6636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63970.exe
      4⤵
      PID:9288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17844.exe
      4⤵
      PID:15196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35677.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35677.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14037.exe
      4⤵
      PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41251.exe
        5⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54422.exe
        6⤵
        
        PID:9688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11721.exe
        6⤵
        
        PID:14316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
        6⤵
        
        PID:16496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46100.exe
        6⤵
        
        PID:12964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59658.exe
        5⤵
        
        PID:10120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57252.exe
        5⤵
        
        PID:13204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53010.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8994.exe
        5⤵
        
        PID:10424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44006.exe
        6⤵
        
        PID:2168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exe
        5⤵
        
        PID:16480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24762.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47540.exe
      4⤵
      PID:11000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56589.exe
      4⤵
      PID:15984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54033.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54033.exe
    3⤵
    PID:4208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10410.exe
      4⤵
      PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54422.exe
        5⤵
        
        PID:9564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12675.exe
        5⤵
        
        PID:15276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11635.exe
        5⤵
        
        PID:16816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16896.exe
      4⤵
      PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32490.exe
      4⤵
      PID:3732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9060.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9060.exe
    3⤵
    PID:7844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
      4⤵
      PID:11356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47565.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:17012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9037.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9037.exe
    3⤵
    PID:10024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25403.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25403.exe
    3⤵
    PID:14736
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39980.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39980.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16230.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16230.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48430.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9901.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43555.exe
        6⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26284.exe
        7⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5989.exe
        8⤵
        
        PID:9248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12675.exe
        8⤵
        
        PID:15260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22024.exe
        8⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13803.exe
        7⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12764.exe
        7⤵
        
        PID:14024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17929.exe
        6⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18294.exe
        7⤵
        
        PID:8296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
        8⤵
        
        PID:11300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47565.exe
        8⤵
        
        PID:17148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54866.exe
        7⤵
        
        PID:12160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18923.exe
        7⤵
        
        PID:16940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29179.exe
        6⤵
        
        PID:9836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52069.exe
        6⤵
        
        PID:12320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59860.exe
        6⤵
        
        PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30788.exe
        5⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16964.exe
        6⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45870.exe
        7⤵
        
        PID:9612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55929.exe
        7⤵
        
        PID:15528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40523.exe
        7⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49081.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36714.exe
        6⤵
        
        PID:14868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4027.exe
        6⤵
        
        PID:15188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31750.exe
        6⤵
        
        PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40684.exe
        5⤵
        
        PID:6564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46638.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12675.exe
        6⤵
        
        PID:15244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29674.exe
        5⤵
        
        PID:10092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4675.exe
        5⤵
        
        PID:14284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48474.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43747.exe
        5⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11562.exe
        6⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25699.exe
        7⤵
        
        PID:7736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9461.exe
        8⤵
        
        PID:11044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exe
        8⤵
        
        PID:16472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38686.exe
        8⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13524.exe
        7⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28928.exe
        7⤵
        
        PID:16520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6736.exe
        7⤵
        
        PID:16824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48292.exe
        6⤵
        
        PID:9548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52069.exe
        6⤵
        
        PID:13664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46212.exe
        6⤵
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53621.exe
        6⤵
        
        PID:17244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1100.exe
        5⤵
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25123.exe
        6⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
        7⤵
        
        PID:11276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47565.exe
        7⤵
        
        PID:16984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31889.exe
        6⤵
        
        PID:11240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28928.exe
        6⤵
        
        PID:16636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41947.exe
        6⤵
        
        PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39274.exe
        5⤵
        
        PID:9396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26204.exe
        5⤵
        
        PID:15132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34843.exe
        5⤵
        
        PID:16564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36356.exe
      4⤵
      PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53747.exe
        5⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1381.exe
        6⤵
        
        PID:8796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
        7⤵
        
        PID:11308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47565.exe
        7⤵
        
        PID:16968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25146.exe
        7⤵
        
        PID:13108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29977.exe
        6⤵
        
        PID:11996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36412.exe
        6⤵
        
        PID:16836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44370.exe
        5⤵
        
        PID:9296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4019.exe
        5⤵
        
        PID:14080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2988.exe
        5⤵
        
        PID:16904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46549.exe
      4⤵
      PID:6548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe
        5⤵
        
        PID:3564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30451.exe
        6⤵
        
        PID:15008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12675.exe
        5⤵
        
        PID:15252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1683.exe
      4⤵
      PID:9968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45617.exe
      4⤵
      PID:13944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13268.exe
      4⤵
      PID:16604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23577.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23577.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19030.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13845.exe
        5⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56627.exe
        6⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42798.exe
        7⤵
        
        PID:8568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18206.exe
        8⤵
        
        PID:11148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exe
        8⤵
        
        PID:16456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24954.exe
        8⤵
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35841.exe
        7⤵
        
        PID:13432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9620.exe
        7⤵
        
        PID:16604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58388.exe
        7⤵
        
        PID:6212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6891.exe
        6⤵
        
        PID:10680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54955.exe
        7⤵
        
        PID:15712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47945.exe
        6⤵
        
        PID:14340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21574.exe
        6⤵
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61074.exe
        5⤵
        
        PID:6680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24054.exe
        6⤵
        
        PID:7692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
        7⤵
        
        PID:11268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47565.exe
        7⤵
        
        PID:17212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24762.exe
        7⤵
        
        PID:7320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36308.exe
        6⤵
        
        PID:10612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61300.exe
        6⤵
        
        PID:16552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48683.exe
        6⤵
        
        PID:4032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39274.exe
        5⤵
        
        PID:9404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43404.exe
        5⤵
        
        PID:12676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35012.exe
      4⤵
      PID:5952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64619.exe
        5⤵
        
        PID:7268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61099.exe
        6⤵
        
        PID:14676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26833.exe
        6⤵
        
        PID:16900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51086.exe
        6⤵
        
        PID:4144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38796.exe
        5⤵
        
        PID:10808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26624.exe
        5⤵
        
        PID:888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14667.exe
        5⤵
        
        PID:5832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62905.exe
      4⤵
      PID:8072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26590.exe
        5⤵
        
        PID:14964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15827.exe
      4⤵
      PID:12828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29811.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29811.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5101.exe
      4⤵
      PID:5060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10986.exe
        5⤵
        
        PID:7012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23411.exe
        6⤵
        
        PID:9728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12889.exe
        6⤵
        
        PID:16312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47731.exe
        6⤵
        
        PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53981.exe
        5⤵
        
        PID:10476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9219.exe
        5⤵
        
        PID:16440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23686.exe
        5⤵
        
        PID:4592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48978.exe
      4⤵
      PID:7976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42902.exe
        5⤵
        
        PID:11084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exe
        5⤵
        
        PID:8096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33890.exe
        5⤵
        
        PID:12216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57828.exe
      4⤵
      PID:11632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34794.exe
      4⤵
      PID:16540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24909.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24909.exe
      4⤵
      PID:5836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48849.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48849.exe
    3⤵
    PID:6992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44718.exe
      4⤵
      PID:8548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41130.exe
      4⤵
      PID:16056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31003.exe
      4⤵
      PID:6008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2553.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2553.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:10016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52630.exe
      4⤵
      PID:15048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20162.exe
      4⤵
      PID:6964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44230.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44230.exe
    3⤵
    PID:14728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8875.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8875.exe
    3⤵
    PID:14580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60457.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60457.exe
    3⤵
    PID:17156
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15964.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15964.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50542.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50542.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60062.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29990.exe
        5⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13949.exe
        6⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61931.exe
        7⤵
        
        PID:9128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38494.exe
        8⤵
        
        PID:14324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55821.exe
        7⤵
        
        PID:14208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62660.exe
        7⤵
        
        PID:16524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10457.exe
        6⤵
        
        PID:10200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32555.exe
        6⤵
        
        PID:13260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5676.exe
        6⤵
        
        PID:10960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57139.exe
        6⤵
        
        PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27440.exe
        5⤵
        
        PID:7088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18206.exe
        6⤵
        
        PID:11140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exe
        6⤵
        
        PID:16488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-258.exe
        6⤵
        
        PID:2808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48034.exe
        5⤵
        
        PID:11160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28427.exe
        5⤵
        
        PID:16304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52853.exe
        5⤵
        
        PID:16768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26076.exe
      4⤵
      PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16772.exe
        5⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45910.exe
        6⤵
        
        PID:14640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27267.exe
        5⤵
        
        PID:11908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59874.exe
        5⤵
        
        PID:17184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63097.exe
      4⤵
      PID:7716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63766.exe
        5⤵
        
        PID:11508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47565.exe
        5⤵
        
        PID:16920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40606.exe
        5⤵
        
        PID:6756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33133.exe
      4⤵
      PID:11916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33611.exe
      4⤵
      PID:16780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49957.exe
      4⤵
      PID:16644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44218.exe
      4⤵
      PID:6688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40004.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40004.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19849.exe
      4⤵
      PID:6524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45875.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14217.exe
        5⤵
        
        PID:11696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43065.exe
        5⤵
        
        PID:16596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43684.exe
      4⤵
      PID:8856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35245.exe
      4⤵
      PID:11852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35635.exe
      4⤵
      PID:16712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22956.exe
      4⤵
      PID:4592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48748.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48748.exe
    3⤵
    PID:5964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48366.exe
      4⤵
      PID:3028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37038.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62038.exe
        6⤵
        
        PID:14392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32764.exe
        5⤵
        
        PID:14740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65348.exe
        5⤵
        
        PID:17296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23428.exe
        5⤵
        
        PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18324.exe
      4⤵
      PID:9776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45837.exe
      4⤵
      PID:16012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52709.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52709.exe
    3⤵
    PID:8172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44758.exe
      4⤵
      PID:17120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62298.exe
      4⤵
      PID:10764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56948.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56948.exe
    3⤵
    PID:11736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58602.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58602.exe
    3⤵
    PID:17064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2637.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2637.exe
    3⤵
    PID:17400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48587.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48587.exe
    3⤵
    PID:8588
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17984.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17984.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57021.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57021.exe
    3⤵
    PID:5660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54131.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28278.exe
        5⤵
        
        PID:7528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55058.exe
        5⤵
        
        PID:11760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1456.exe
        5⤵
        
        PID:17404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11156.exe
        5⤵
        
        PID:13308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29948.exe
      4⤵
      PID:8876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4595.exe
      4⤵
      PID:11684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19241.exe
      4⤵
      PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48683.exe
      4⤵
      PID:4720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50497.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50497.exe
    3⤵
    PID:6640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10981.exe
      4⤵
      PID:7784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60974.exe
        5⤵
        
        PID:13008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55261.exe
        5⤵
        
        PID:16940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36993.exe
      4⤵
      PID:12620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45029.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45029.exe
    3⤵
    PID:1208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34462.exe
      4⤵
      PID:13912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16060.exe
      4⤵
      PID:3616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50996.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50996.exe
    3⤵
    PID:12744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9500.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9500.exe
    3⤵
    PID:16884
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10476.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10476.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4525.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4525.exe
    3⤵
    PID:6080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59118.exe
      4⤵
      PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54422.exe
        5⤵
        
        PID:9572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20843.exe
        5⤵
        
        PID:15232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47850.exe
      4⤵
      PID:11592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26128.exe
      4⤵
      PID:16576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44794.exe
      4⤵
      PID:7312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48978.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48978.exe
    3⤵
    PID:7900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49469.exe
      4⤵
      PID:13000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45858.exe
      4⤵
      PID:16520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50044.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50044.exe
    3⤵
    PID:772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1628.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1628.exe
    3⤵
    PID:17024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60820.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60820.exe
    3⤵
    PID:8024
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37542.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37542.exe
  2⤵
  PID:2612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23862.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23862.exe
    3⤵
    PID:7204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12725.exe
      4⤵
      PID:10032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11337.exe
      4⤵
      PID:13904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18324.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18324.exe
    3⤵
    PID:10100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54690.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54690.exe
    3⤵
    PID:15496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25677.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25677.exe
    3⤵
    PID:13152
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64076.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64076.exe
  2⤵
  PID:7256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58670.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58670.exe
    3⤵
    PID:12656
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63669.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63669.exe
  2⤵
  PID:11856
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11476.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11476.exe
  2⤵
  PID:16768
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9329.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9329.exe
  2⤵
  PID:3556
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53663.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53663.exe
  2⤵
  PID:6748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 8092 -ip 8092
1⤵
PID:12488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 7800 -ip 7800
1⤵
PID:15340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 8564 -ip 8564
1⤵
PID:16820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 15752 -ip 15752
1⤵
PID:16884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 15752 -ip 15752
1⤵
PID:16856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 15032 -ip 15032
1⤵
PID:14576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12763.exe

Filesize
468KB

MD5
7cad4d7ae778f6c8e8d0092d7ff3dd45

SHA1
838e63c09d1d8e101d59f2962d4a43c5d365e7ee

SHA256
597aecfb77f648480f24d26297af48093cd58661b1dd22f6d360b28cbe64b748

SHA512
89af054a38635c3dd7dc9d066eb805d27d7d1b1f3c534ad828f485a100fc9eaf90d7cfc8565ee83873c7ce430322f21fa2a926b63eb0048dc80b050ed1aaf7d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15563.exe

Filesize
468KB

MD5
6aae91f9e3524205139ed912113fd4da

SHA1
a730ef25ee147084d1996d0b30074498e3c0930d

SHA256
9a7da49fe3a97931418ea46d57b869c72a850e676e4c83cbcae09fbb422014fc

SHA512
f44e9b7c835ae854174fe74a338dbfb686421073b5fe42345709f880e803eb65a6001f649296300542f89c883273c0fc2edc6a44a2e9df9fc4a52fbc75bf312f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15964.exe

Filesize
468KB

MD5
3c778d8b6092deeefb979baaca624908

SHA1
dc0f3e71e6ef8c5c3b5252f887ce428e1289ee92

SHA256
74e7537b501e77b5bcace47c27f93d20630e08485ed9e299c21595173563405d

SHA512
d4f2a58fe8d689368ad6d28a69ca4824a0e57cc78c6972e5f6c2c0e91012c63c7e0f38c2717123d01cf22b2f94ab1ae41a9133ce1f554de0c6871795d87cb829

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16230.exe

Filesize
468KB

MD5
e23aba4b6c00200d59ec3bf2de4a5756

SHA1
bfdb9d4cdeef1fc9bf4de094cb202825f630c04c

SHA256
643bddd24e16ecf147c9d444689ba309bf378a3512444bb1ed92165a2df1fae8

SHA512
22e577be4ed244cca7dc2663231e4e621b4df6cd36d39629d7161e2e55ad777307178d65bc7c4f17c22b2d22052c63a7f46a9b0a1053801698e810004a09eaa4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17984.exe

Filesize
468KB

MD5
2bf02dce401ce319380c67533c46717b

SHA1
6f678a2142a1633f04f373e12fb95ba7b8dfa473

SHA256
5876f23231db4e8044ef339b2125cb594c41f0765b32dacf766a833b40409560

SHA512
375512e0c5f86cd7691f48c8b2171cece230f439f597d7d20432521a9d3b38b77ed5877cd5c3309aa977d49ba6ef6b0dc78b41ca715ac31a600f784f21ac220d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17987.exe

Filesize
468KB

MD5
6e97394bed491d2ac19fd79f926aeb7d

SHA1
7304080d777ac358f510b0a0b7d24d41dbff3ff4

SHA256
98358332cc909b2dbe8b9c00f2ad5d34026e673c29e5c5a108ca80432e12c07a

SHA512
a764c4414e48f3e710121e64567f5ad950027fe1c2c80e773ec48c84b4040290b824c48d09188a0adc15b8d178b3ec2be3fdecc86fcbaf1c7d4f4fd3d84c2f44

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19849.exe

Filesize
468KB

MD5
0f0693de6c1e24e97b152ae9c8b614ef

SHA1
7c20033b44a9652a7bb923fb6fe5c729219486c7

SHA256
f81b7968d7ccd86e8fc5dcd2b4c54de94080ca605e7db98878aec01f9018b262

SHA512
61cf5b7224737b560a28e7a1461eccc72b6ccb0bbfe337d80aa249dc5cd9ee78f93455012d470adcd4e7a38099ffbfd518526cb91e796cab8eeba544a038886d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20292.exe

Filesize
468KB

MD5
4bcbb24a9270a653a3f8a9e3f48d683f

SHA1
dac59b16e39ebf99a5dc0b7915c4fa56ef6a6195

SHA256
8d8aa8e3756269154306babb08282737c5aa80b08c268014689dec7636dcc3dd

SHA512
97facb906e7c53b2bc4ba95b9bc88615d8f058c27aac34c1ac922fedeef865d0b8b45290026a5aeee6c69542ff01fa4cd73b6371fff2913b914e62a7743355a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23577.exe

Filesize
468KB

MD5
8ef74d42a02c4265f1a9344a8c5cc7fd

SHA1
697063652d740db2634aba781898fda89e737f1f

SHA256
8df875eff2fd6782a0428bd54339d14f42a26f681a88b50a9a09f0f9ebce0a62

SHA512
60bc13ff7fe8f1b7b6e7a748c6ff7e13b121eb9a43b2e1d2a1fd0aefec691a8972d7bc4b0cb18b20326be6140963d898d2e88d17d8115859d2f86731049489fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2410.exe

Filesize
468KB

MD5
a83d9585d3e0da089d22d627bb35edbf

SHA1
4bf634a905ceecdb4e00de86baeb3b93534fac30

SHA256
b2f668a66d6c852582f28e5d2a79241745b004d5c9f33d0436d5dac6749a41a8

SHA512
c76dcbadfaa2add72706ad0025cae22ee26c9d166c2e11c151049dd1b4221d330ad93ee72b57434f2386606337a5c33dccfe5515b943d6fa1461ad07a094c56a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27107.exe

Filesize
468KB

MD5
1cfac0bcb070ccd502f30dc922358776

SHA1
e74df3fc3129a42d0b5752ba145b15fc7dab403e

SHA256
00e2514a71fcb240dfccdba22541b2a55dba0821b98f78767638dc0cc3b511fe

SHA512
5a4b66370330bcd33229858c40189324d10bbd8339be8aeaa5bc51e75bb29a0dd9c324bcc085ae0ce2eaa7332ca5dd1270690f04d80d123c6f8b8d2f348e1691

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29833.exe

Filesize
468KB

MD5
a87143cdacdb86cdf349a0d2e67c362f

SHA1
e405a685123dafeee7ca91079059f6cbb6e3475c

SHA256
87e32bebab886bccef344941c333366da30a1ed37aec5777930b208b0c7362df

SHA512
88b828f93af61348ff5e5294dbc9d514bc9e2294cd899f9eec07c0a1af35a9f5bff613e240c5d5482f109a0aa477b5d26210d783290edee6d2da7db1ae33607b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30489.exe

Filesize
468KB

MD5
f4b247675578060f24c7ec760c91b055

SHA1
4c263a3bb8118c280f63dd970a843cf97878b3f8

SHA256
fa1dabdae900acd6731131516718d8b73a2d5fe210828b85f2b91446416ef8b4

SHA512
c2c9ae6dd3b6b765ed1647b7fc018d25a05fb4702c6587840df4f4ccf90e126f0c5d97cce8d444ef141b185a72dafbf79b7a8672d7b4498a5f62518a74b4a113

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33443.exe

Filesize
468KB

MD5
0d8426eb6160db7cc801ab8c7dd2bfe0

SHA1
f55cedd926739fe6e5e16ba51c0619c3aff18430

SHA256
3d289a07c0e658d70bd8a5b0aed8baf70a9f9bd7a8081ace44ff55f453807a66

SHA512
348ccbdfc02bf0ebd013a0c013db03f3b2b48128801767bcd9e72cd91e7e393e6767001848c692f82e726efb9f48740748504d3cba83e8d8bb0db0ab87142c98

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3379.exe

Filesize
468KB

MD5
90485538ec11971a4f6bd3864c548add

SHA1
42d3b70639d6d3b30b499d1f98af62906c6cf90d

SHA256
04fc7ac4ffafeef825da2ee6ec536be0d6dc91496004849df8449265ffbaa9d2

SHA512
9e74c4aad9bdfde9736841122c0ba5e8776660b57a6b99db0a8d18fffe0d58f4f9590a3f5799c38ef760b78f4601f2d8eea190a3827a56bafa89a5c75df215f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35481.exe

Filesize
468KB

MD5
6d5776ba6596c2b9303824f4359f3b8d

SHA1
b831b57f4ecc76adf2bc2f9aa7d099d191f87808

SHA256
3ea71b915b0930e981d28908bead574c72280ebac61f7d147c31dcc501a1ca50

SHA512
6de9c30ed284551fdd2aa9d93690dcbe55d0a5e3eb707cc6c38c44729042dc38a5a8d8dd74199ff5a91f48fcd3f1d3df867d4b170dff34d3549f9e14c0bfc66c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3868.exe

Filesize
468KB

MD5
2896ec5feb804253deb4e2208f1333a8

SHA1
02efb183651bdccec22a8472dc4c43f25c96b0f6

SHA256
baa2c699e468eb2ccf1754d643ea18d3ef7f2a0feffbdbab227e798d897cca26

SHA512
35fe365151d89d3c4e5f9c54b00b3da8e325f451dd3024e80375f939c9232ecff6c636500afb4b4ae737f414b8a65487258d73ab5f943dcd7d2bf3f8bfa23e6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38844.exe

Filesize
468KB

MD5
3b0dd344eb00b9828cac7dda3e1ed009

SHA1
bf33c160b181ab441ac70aa59684ee214e4c8e78

SHA256
9133d0d3aadabaad7ef3801ec0fd68feb680da5bbec596c817c1627f4c9fad18

SHA512
031729af5aead9b91ff098aa659eb49b81a4bcb831ac16253a04b7f1837e48d77f17c9f209baa7a6906116a68b1b61feb1fa66f724254f11222f5afc1794634c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39980.exe

Filesize
468KB

MD5
5c7f978f54f958519f8e673a9b896c77

SHA1
ad79753a4ad91632ca848c1d6d5b4a2000e91796

SHA256
788b5668bb29d82e0fe0c4f899059f055e71f5f0c07fc25ae108f7811f18d588

SHA512
f882443681fc2a4ce0ec42acedd56dfe9518ee5868d6ad5fcf4d38dcbc18443c49bf6e86ed3f42630b1471209965330807f061714bd1cebee553d9183d2345b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40060.exe

Filesize
468KB

MD5
29804c613f67088e1fe8f37aa8a67f73

SHA1
0dfd51a0e6d64792ec12405e244d318d7723c4f8

SHA256
bf5db53709ebe001458fd31d4290b50854bc831a20e1b5585f00ba9976f01eb0

SHA512
6eb336be5c9308dde339cf7ecff5b304f0d1969643e388b0fc65680e3c5f5f8698fd905e42e62d51d08207b32f790b00e5a2eb30321153d288850718f7898e4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41118.exe

Filesize
468KB

MD5
e6a82bb98fc77aeb3434ef42796212cf

SHA1
e1ff88664f719e24235bcbe9fbabb702f8ee23ae

SHA256
f505bf98472d91c9b83ba75cac5133c40a91a39646b7e8f5fa73f5a6b4759fb9

SHA512
00c18265efc7b9174a3cb615399ba8b3b0a20a5d5cacb39db5308d66d53c5c2734870c3d3baf97869601447ade79841621ca6e648c55e7d8aae8b20059d202ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42099.exe

Filesize
468KB

MD5
012c3e3510a700920c8f983d662a7f70

SHA1
513e735ede94595c021dd0c6a6bf1571818b5017

SHA256
79cd946f9579fb432e51ab2e40c17c2b46c1663198279deca2ff319fa03c70fe

SHA512
60decf19858b9d86fabc07ae4ff9b071ca57d49bae5ca21c317391ba7424416e2562eeacab86431b23ca894bde369b9d3e51d93739d20790686d6c8897e9ba22

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43178.exe

Filesize
468KB

MD5
1fce50be9f5221216a7aa01552205c4b

SHA1
edabf4f2292f4bc3d29ba8fb660233003ec45782

SHA256
47e605a8365e3d1caa91184f2bfbd3d523cb010677ef3149a4e316d363d86eb3

SHA512
1c25151c304746afbd8819da6943a45f9dc7c54362a305101e5311f370a645106e0fd7380af2605be32c2f833a741980e84a2300d938f1c6c8b74291a2033a0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43443.exe

Filesize
468KB

MD5
8d61e4dd68546a1348bfcba7396047da

SHA1
628bf932d7702723196a60e5ba9d3f1859c99b13

SHA256
13108fe518c0eb3ba4dcf79e22d2ae765196af6afe8d5e948193656d31fae70d

SHA512
98333adcf8aaaadbfaecd159c556ca17339dd80e03d13f24b9d6c068650f4f5dd57ab88276f89958c36abd5a1249242e6b66132d8a419818ba3d20d4ccb760a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45373.exe

Filesize
468KB

MD5
d878f2982ffad1d55634c76eb3582ab6

SHA1
a5ac50c6b14687a7b2724a3b586d8c0cb1b3e0ca

SHA256
db70a4acaf54214fb98c04d134f8e71496466d4b72a72019505cf6d0effd0e03

SHA512
0dd25ba508022e3ea07d9752f102d535e360ba086a86886175ba84bf8c72337925901c025e1e8f50b99666048b3aecfa827d5ae1cf14d81fbfff0ea542d03d08

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46110.exe

Filesize
468KB

MD5
ec86f5995129fee7813149011adb9ea4

SHA1
a6416417bb1faff95689bc087eda9226e16b7b12

SHA256
5f9e1fbf8bfbbe00058b4cc3f0a2e6f8b1e45b3bd3cafc5f4c2f84b38997ad19

SHA512
4e2ec4c200eb36cb5d537484b7b6f1b52c5d2a996ac4cb235efa905fda204cddc20ae3aa31dcfdbef41b28cc3b3c02f2bdad6af20e7bad979f2ef1545c286aa3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48430.exe

Filesize
468KB

MD5
08a3c8cb6e100ffb5a3e7840ecc7754d

SHA1
869a42ffafcb19f728d3d0fbb1d3526c61dc5447

SHA256
69f5a14753ec5822f1acd780db8456e06b6a8e3e37f925c13d1d451f7794f05b

SHA512
35fe4d04a14aef474e03ce4b6a62c8f8d25e7d202cbc4bfa34cfdd6d8558ddc12cdfa7ab7ad848a3cf7c66fefe4f0bcc1e915b8e7bc65d50650dcc08f38c733a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48622.exe

Filesize
468KB

MD5
04832a77a3361584ebdce961b749ca6c

SHA1
20c04f821c3848109b9847d6cf3b7a9627d59be5

SHA256
3a7b7c031fa57dd29bbf68d8cb518f4dc5f53cdc9381ec7bf219ea15767f7c2f

SHA512
bfee179f19616f1a7f3f809597150a24ccf10aaf91ebe07d108ba56f169909187f33a742699c57114a82b8fab7f31a9c44273b09ee549b4e30c117257e8ca953

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49758.exe

Filesize
468KB

MD5
14ba1a6de9b5c5ed86de49c3145f7533

SHA1
75e750027f69e8cb2f871b9875cac2140e26d637

SHA256
4d712bdd71765ece970e574f3bbb54b225ff4c21b602afd068f04114a6dded52

SHA512
b478f9e5654c32ac93441d8114483f50e4980603c5ab8fb4627d40942ff73e7468988ed457f74889f3f72e7826bdb7b33ad39f3828c0252a8b974af8c28a378f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50542.exe

Filesize
468KB

MD5
cc2d16ff3c1997793bb8829db570ed92

SHA1
9e485fa1f1469299877bd33c4c644da129b0810c

SHA256
f4842b84929a53e67f51a7723150827f8e790f37585c7920a98be879cae474ce

SHA512
957bbefdad5c8d18836a5f6ed474173338eed1416f8724cc7f468f28a0a5ca6dd9c594484e7e0b3ba4fdfba26a36ec06cdb15cf9789dea5da899b2d35fbed4c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59108.exe

Filesize
468KB

MD5
31686c4425564e018e99eac33958e3ce

SHA1
cf5d019603c0b7afa7d6dcd364e8e58cc7a7e1a7

SHA256
8f401c088c0c13871120de8d471451208d4687562ed264f9e50a729b60a80624

SHA512
0e9ef762adc131865e8b6dc04c51cc351d4431724e08dfac13e2af95307760c02cfcfbb264db5afe69f755b6ba7e7c599334e8373f156f78df6b0bcbe63adaec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62298.exe

Filesize
468KB

MD5
c22f1afe1f2900ac6e531eb5a1dd93fd

SHA1
b06068312f80304d284a39598099fd97ac5d0b7e

SHA256
e8efd63cd9c179f44b86c4bcb9dd13ee5cfecbe31b77de597125b03cb7581f77

SHA512
4d8ec18cacdfa6667c826f3c228d4ff8df568a163bffbb91f54cf1d68c0069c4218e4b0746cd62c55907970d6c4503080691596def3ad545bf403a46322db86a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62446.exe

Filesize
468KB

MD5
7db94e3228ed0a8f145a45892a057f50

SHA1
7af59346e298b589a66ed8fa2654cfe050270ed4

SHA256
c742f2596f99abdceb92819dcc4ef77a84f1e7ba02048908431ccfa91ac79c1d

SHA512
02f25af6d1c5e9da86768512180b259d686a42466f4c88facacb75cce4e6e200f1caaf31442cc5bbd36f51059125e4f375874ef4a4e812ede3b6c981ede31cc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65430.exe

Filesize
468KB

MD5
fdcbe9f955c072112cb19cdea9428b2a

SHA1
d9c27da1cc8f15071b7cba6a9c378a64a137de14

SHA256
a9d98225257d65b4503c43876acee44fc5e22f52df9fe34e3c2e06a072dfdebe

SHA512
1edfe208f0fafc80a190142c3dfac6a562c98db58b7e0cecd4d02908a91e3547901889225f2afc15b56b4220d19c02d111eaf0a41dc8944c94dda45eef04be4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-690.exe

Filesize
468KB

MD5
18318eca6baed39fe1d370a71e47d0b3

SHA1
5849a855bafa8dd0e68cda3fcef7c4de2af2e93a

SHA256
35a02a3847893e9073e042d341b93f585856bb29760bfa2b8fc2ee295db4465f

SHA512
24ca9bea061ba521d69a1533a79542950b9d0a1fcd53ddf26b6d79607ac606c99e83573128f901cb0928e1afe14de4b0f9f91a6df189405ce1f2c0be7919c25e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8362.exe

Filesize
468KB

MD5
d0d07af02d2f162013dd2b6c4a2b3a58

SHA1
2c061dc837441a742feb10e7c843f7afda40ea1f

SHA256
fcf820a0010ab13d9dc6285eb84bb44724b1533d479aacba240fe61ef503aab5

SHA512
73bd6f85a050b344edb712e42a07546140cac928e88b1947a3007d9d3a0fb5727875270e28116fb419a192d5e24d2ee7cbcf0ce042a7d6935aaac2a677e49a58

Download Submit
memory/2840-2859-0x00007FF8CB8F0000-0x00007FF8CBAE5000-memory.dmp

Filesize
2.0MB

Download
memory/10960-2849-0x00007FF8C9AF0000-0x00007FF8C9B73000-memory.dmp

Filesize
524KB

Download
memory/14796-2855-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16884-2706-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/17264-2519-0x00000000765A0000-0x000000007661A000-memory.dmp

Filesize
488KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads