ccd397d5604f59daca4066c703690543e93aea9a0ade3566eb6384940dea1b2f

Analysis

max time kernel
120s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
11-09-2024 10:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f71a0337f9baac6026a923b1eee970d0N.exe
Size

468KB
MD5

f71a0337f9baac6026a923b1eee970d0
SHA1

5aed78f63e53f7f181c37545f45fa05e2ee286f9
SHA256

ccd397d5604f59daca4066c703690543e93aea9a0ade3566eb6384940dea1b2f
SHA512

8dbbd5d6009849dc8e3008f4e6db8e2659261de5ba4ab73f37957c45bb9c94f1a31d6309b2e92f561b202bb5d23e037700836d9889f7cbae25aee59fed7c6115
SSDEEP

3072:B1NfogCday8Unb/EPz5Fff1DfPWhC8zzmHe7VpVnv2Pu3apOhlVl0:B1hosLUnoP1FffKzxpv2PkmOhl

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3488	Unicorn-60447.exe
4436	Unicorn-25767.exe
2664	Unicorn-54910.exe
4076	Unicorn-53919.exe
5032	Unicorn-39429.exe
1276	Unicorn-42221.exe
1920	Unicorn-40441.exe
4732	Unicorn-64007.exe
4660	Unicorn-43395.exe
1976	Unicorn-23529.exe
2752	Unicorn-51298.exe
2300	Unicorn-14614.exe
4756	Unicorn-8484.exe
1380	Unicorn-46143.exe
4504	Unicorn-48181.exe
2068	Unicorn-5686.exe
4296	Unicorn-35021.exe
4736	Unicorn-18493.exe
4244	Unicorn-38359.exe
4156	Unicorn-42443.exe
4772	Unicorn-2157.exe
2692	Unicorn-22023.exe
4964	Unicorn-60817.exe
5028	Unicorn-45765.exe
4224	Unicorn-54695.exe
2944	Unicorn-29734.exe
4004	Unicorn-35811.exe
512	Unicorn-39895.exe
2712	Unicorn-24113.exe
3704	Unicorn-23294.exe
4104	Unicorn-37133.exe
4404	Unicorn-25287.exe
4484	Unicorn-38093.exe
4280	Unicorn-1514.exe
1360	Unicorn-1514.exe
3248	Unicorn-2069.exe
1032	Unicorn-34187.exe
392	Unicorn-14321.exe
4248	Unicorn-9682.exe
3020	Unicorn-52561.exe
4896	Unicorn-1322.exe
1488	Unicorn-36225.exe
4572	Unicorn-22489.exe
5048	Unicorn-42355.exe
404	Unicorn-50523.exe
2984	Unicorn-61814.exe
3060	Unicorn-21743.exe
4140	Unicorn-560.exe
1204	Unicorn-38633.exe
1504	Unicorn-9490.exe
1764	Unicorn-41898.exe
1540	Unicorn-29016.exe
976	Unicorn-31425.exe
3168	Unicorn-42361.exe
2652	Unicorn-51291.exe
4432	Unicorn-30679.exe
4376	Unicorn-14897.exe
4532	Unicorn-4128.exe
2500	Unicorn-18235.exe
3544	Unicorn-52945.exe
2780	Unicorn-43891.exe
2272	Unicorn-7497.exe
5084	Unicorn-60035.exe
3016	Unicorn-62073.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
9032	6488	WerFault.exe	298
10040	6360	WerFault.exe	294
13272	6640	WerFault.exe	261

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43397.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17845.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40444.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53787.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8914.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47407.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54506.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12894.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f71a0337f9baac6026a923b1eee970d0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35811.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52734.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23786.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55399.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18317.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61477.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61477.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31425.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45213.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4425.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40770.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18648.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15819.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6811.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21691.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1758.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35753.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65022.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28560.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55605.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18827.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16552.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62866.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7443.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23419.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62002.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10164.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32660.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14098.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39375.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55515.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46775.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-865.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55591.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4342.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41551.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40046.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14897.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14290.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15717.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59682.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62547.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38345.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9005.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63765.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14174.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	15868	dwm.exe
Token: SeChangeNotifyPrivilege	15868	dwm.exe
Token: 33	15868	dwm.exe
Token: SeIncBasePriorityPrivilege	15868	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3480	f71a0337f9baac6026a923b1eee970d0N.exe
3488	Unicorn-60447.exe
4436	Unicorn-25767.exe
2664	Unicorn-54910.exe
4076	Unicorn-53919.exe
1276	Unicorn-42221.exe
5032	Unicorn-39429.exe
1920	Unicorn-40441.exe
4732	Unicorn-64007.exe
4660	Unicorn-43395.exe
2300	Unicorn-14614.exe
1976	Unicorn-23529.exe
2752	Unicorn-51298.exe
4756	Unicorn-8484.exe
1380	Unicorn-46143.exe
4504	Unicorn-48181.exe
2068	Unicorn-5686.exe
4736	Unicorn-18493.exe
4244	Unicorn-38359.exe
4296	Unicorn-35021.exe
4772	Unicorn-2157.exe
4156	Unicorn-42443.exe
2692	Unicorn-22023.exe
4224	Unicorn-54695.exe
5028	Unicorn-45765.exe
4964	Unicorn-60817.exe
2944	Unicorn-29734.exe
512	Unicorn-39895.exe
3704	Unicorn-23294.exe
2712	Unicorn-24113.exe
4004	Unicorn-35811.exe
4104	Unicorn-37133.exe
4404	Unicorn-25287.exe
4484	Unicorn-38093.exe
4280	Unicorn-1514.exe
1360	Unicorn-1514.exe
3248	Unicorn-2069.exe
1032	Unicorn-34187.exe
392	Unicorn-14321.exe
4248	Unicorn-9682.exe
1488	Unicorn-36225.exe
3020	Unicorn-52561.exe
4572	Unicorn-22489.exe
4896	Unicorn-1322.exe
2984	Unicorn-61814.exe
1504	Unicorn-9490.exe
3060	Unicorn-21743.exe
1764	Unicorn-41898.exe
4140	Unicorn-560.exe
1204	Unicorn-38633.exe
5048	Unicorn-42355.exe
404	Unicorn-50523.exe
1540	Unicorn-29016.exe
4432	Unicorn-30679.exe
4532	Unicorn-4128.exe
4376	Unicorn-14897.exe
976	Unicorn-31425.exe
3168	Unicorn-42361.exe
2500	Unicorn-18235.exe
2652	Unicorn-51291.exe
3544	Unicorn-52945.exe
2780	Unicorn-43891.exe
2272	Unicorn-7497.exe
5084	Unicorn-60035.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 3488	3480	f71a0337f9baac6026a923b1eee970d0N.exe	84
PID 3480 wrote to memory of 3488	3480	f71a0337f9baac6026a923b1eee970d0N.exe	84
PID 3480 wrote to memory of 3488	3480	f71a0337f9baac6026a923b1eee970d0N.exe	84
PID 3488 wrote to memory of 4436	3488	Unicorn-60447.exe	85
PID 3488 wrote to memory of 4436	3488	Unicorn-60447.exe	85
PID 3488 wrote to memory of 4436	3488	Unicorn-60447.exe	85
PID 3480 wrote to memory of 2664	3480	f71a0337f9baac6026a923b1eee970d0N.exe	86
PID 3480 wrote to memory of 2664	3480	f71a0337f9baac6026a923b1eee970d0N.exe	86
PID 3480 wrote to memory of 2664	3480	f71a0337f9baac6026a923b1eee970d0N.exe	86
PID 4436 wrote to memory of 4076	4436	Unicorn-25767.exe	89
PID 4436 wrote to memory of 4076	4436	Unicorn-25767.exe	89
PID 4436 wrote to memory of 4076	4436	Unicorn-25767.exe	89
PID 3488 wrote to memory of 1276	3488	Unicorn-60447.exe	90
PID 3488 wrote to memory of 1276	3488	Unicorn-60447.exe	90
PID 3488 wrote to memory of 1276	3488	Unicorn-60447.exe	90
PID 3480 wrote to memory of 5032	3480	f71a0337f9baac6026a923b1eee970d0N.exe	91
PID 3480 wrote to memory of 5032	3480	f71a0337f9baac6026a923b1eee970d0N.exe	91
PID 3480 wrote to memory of 5032	3480	f71a0337f9baac6026a923b1eee970d0N.exe	91
PID 2664 wrote to memory of 1920	2664	Unicorn-54910.exe	92
PID 2664 wrote to memory of 1920	2664	Unicorn-54910.exe	92
PID 2664 wrote to memory of 1920	2664	Unicorn-54910.exe	92
PID 4076 wrote to memory of 4732	4076	Unicorn-53919.exe	93
PID 4076 wrote to memory of 4732	4076	Unicorn-53919.exe	93
PID 4076 wrote to memory of 4732	4076	Unicorn-53919.exe	93
PID 5032 wrote to memory of 4660	5032	Unicorn-39429.exe	94
PID 5032 wrote to memory of 4660	5032	Unicorn-39429.exe	94
PID 5032 wrote to memory of 4660	5032	Unicorn-39429.exe	94
PID 4436 wrote to memory of 1976	4436	Unicorn-25767.exe	95
PID 4436 wrote to memory of 1976	4436	Unicorn-25767.exe	95
PID 4436 wrote to memory of 1976	4436	Unicorn-25767.exe	95
PID 3480 wrote to memory of 2752	3480	f71a0337f9baac6026a923b1eee970d0N.exe	96
PID 3480 wrote to memory of 2752	3480	f71a0337f9baac6026a923b1eee970d0N.exe	96
PID 3480 wrote to memory of 2752	3480	f71a0337f9baac6026a923b1eee970d0N.exe	96
PID 3488 wrote to memory of 4756	3488	Unicorn-60447.exe	98
PID 3488 wrote to memory of 4756	3488	Unicorn-60447.exe	98
PID 3488 wrote to memory of 4756	3488	Unicorn-60447.exe	98
PID 1276 wrote to memory of 2300	1276	Unicorn-42221.exe	97
PID 1276 wrote to memory of 2300	1276	Unicorn-42221.exe	97
PID 1276 wrote to memory of 2300	1276	Unicorn-42221.exe	97
PID 1920 wrote to memory of 1380	1920	Unicorn-40441.exe	99
PID 1920 wrote to memory of 1380	1920	Unicorn-40441.exe	99
PID 1920 wrote to memory of 1380	1920	Unicorn-40441.exe	99
PID 2664 wrote to memory of 4504	2664	Unicorn-54910.exe	100
PID 2664 wrote to memory of 4504	2664	Unicorn-54910.exe	100
PID 2664 wrote to memory of 4504	2664	Unicorn-54910.exe	100
PID 4660 wrote to memory of 2068	4660	Unicorn-43395.exe	101
PID 4660 wrote to memory of 2068	4660	Unicorn-43395.exe	101
PID 4660 wrote to memory of 2068	4660	Unicorn-43395.exe	101
PID 5032 wrote to memory of 4296	5032	Unicorn-39429.exe	102
PID 5032 wrote to memory of 4296	5032	Unicorn-39429.exe	102
PID 5032 wrote to memory of 4296	5032	Unicorn-39429.exe	102
PID 4732 wrote to memory of 4244	4732	Unicorn-64007.exe	104
PID 4732 wrote to memory of 4244	4732	Unicorn-64007.exe	104
PID 4732 wrote to memory of 4244	4732	Unicorn-64007.exe	104
PID 4076 wrote to memory of 4736	4076	Unicorn-53919.exe	103
PID 4076 wrote to memory of 4736	4076	Unicorn-53919.exe	103
PID 4076 wrote to memory of 4736	4076	Unicorn-53919.exe	103
PID 2300 wrote to memory of 4156	2300	Unicorn-14614.exe	105
PID 2300 wrote to memory of 4156	2300	Unicorn-14614.exe	105
PID 2300 wrote to memory of 4156	2300	Unicorn-14614.exe	105
PID 1276 wrote to memory of 4772	1276	Unicorn-42221.exe	106
PID 1276 wrote to memory of 4772	1276	Unicorn-42221.exe	106
PID 1276 wrote to memory of 4772	1276	Unicorn-42221.exe	106
PID 1976 wrote to memory of 2692	1976	Unicorn-23529.exe	107

C:\Users\Admin\AppData\Local\Temp\f71a0337f9baac6026a923b1eee970d0N.exe
"C:\Users\Admin\AppData\Local\Temp\f71a0337f9baac6026a923b1eee970d0N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60447.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60447.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25767.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25767.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53919.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64007.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38359.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1514.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60803.exe
        8⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63875.exe
        9⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41587.exe
        10⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41551.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:10688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11945.exe
        11⤵
        
        PID:15072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46063.exe
        11⤵
        
        PID:17096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53590.exe
        10⤵
        
        PID:10044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-408.exe
        10⤵
        
        PID:13464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32468.exe
        10⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52770.exe
        9⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64549.exe
        9⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15243.exe
        9⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20429.exe
        8⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14306.exe
        9⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40223.exe
        10⤵
        
        PID:13088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25503.exe
        10⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25577.exe
        9⤵
        
        PID:10812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29380.exe
        9⤵
        
        PID:15300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14870.exe
        9⤵
        
        PID:8336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10480.exe
        8⤵
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19175.exe
        9⤵
        
        PID:14536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52063.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26758.exe
        9⤵
        
        PID:16760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22750.exe
        8⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35362.exe
        8⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54534.exe
        7⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47731.exe
        8⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17275.exe
        9⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18827.exe
        10⤵
        
        PID:9752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54950.exe
        10⤵
        
        PID:13480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63250.exe
        10⤵
        
        PID:17032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
        9⤵
        
        PID:9772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
        9⤵
        
        PID:14424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52120.exe
        9⤵
        
        PID:16416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52962.exe
        8⤵
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51079.exe
        9⤵
        
        PID:14196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19774.exe
        9⤵
        
        PID:16600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10332.exe
        8⤵
        
        PID:12548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13598.exe
        8⤵
        
        PID:15964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62754.exe
        7⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31795.exe
        8⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24271.exe
        9⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38819.exe
        9⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        8⤵
        
        PID:12212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40123.exe
        8⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37002.exe
        8⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4748.exe
        7⤵
        
        PID:8308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6677.exe
        7⤵
        
        PID:11604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64343.exe
        7⤵
        
        PID:15752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35702.exe
        7⤵
        
        PID:18216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2069.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15687.exe
        7⤵
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55515.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25443.exe
        9⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34425.exe
        10⤵
        
        PID:12856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-946.exe
        10⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
        9⤵
        
        PID:9832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16552.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:14380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11855.exe
        9⤵
        
        PID:16396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61130.exe
        8⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52298.exe
        8⤵
        
        PID:12352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55487.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62568.exe
        8⤵
        
        PID:18228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40849.exe
        7⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2054.exe
        8⤵
        
        PID:7364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25577.exe
        8⤵
        
        PID:10820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23994.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63765.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49558.exe
        7⤵
        
        PID:12392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7443.exe
        7⤵
        
        PID:16160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58536.exe
        7⤵
        
        PID:7520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52317.exe
        6⤵
        
        PID:468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57731.exe
        7⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41145.exe
        7⤵
        
        PID:10316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16552.exe
        7⤵
        
        PID:14040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3194.exe
        7⤵
        
        PID:7360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56802.exe
        6⤵
        
        PID:7232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21868.exe
        6⤵
        
        PID:11580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33795.exe
        6⤵
        
        PID:16216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49070.exe
        6⤵
        
        PID:16872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18493.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34187.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37451.exe
        7⤵
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40103.exe
        8⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59615.exe
        9⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54971.exe
        10⤵
        
        PID:13196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54092.exe
        10⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30045.exe
        9⤵
        
        PID:10608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16360.exe
        9⤵
        
        PID:14592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39375.exe
        9⤵
        
        PID:16712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42053.exe
        8⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54409.exe
        8⤵
        
        PID:11976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48483.exe
        8⤵
        
        PID:16180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1507.exe
        8⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34985.exe
        7⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23539.exe
        8⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44670.exe
        8⤵
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33509.exe
        8⤵
        
        PID:16624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10200.exe
        7⤵
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12137.exe
        7⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61602.exe
        7⤵
        
        PID:16520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33729.exe
        6⤵
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40103.exe
        7⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2054.exe
        8⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15977.exe
        9⤵
        
        PID:12000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19447.exe
        9⤵
        
        PID:16040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25577.exe
        8⤵
        
        PID:10828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59391.exe
        8⤵
        
        PID:15948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46431.exe
        8⤵
        
        PID:10236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50030.exe
        7⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15977.exe
        8⤵
        
        PID:11992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40812.exe
        8⤵
        
        PID:13676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20865.exe
        8⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24284.exe
        7⤵
        
        PID:11856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40315.exe
        7⤵
        
        PID:11404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35715.exe
        7⤵
        
        PID:17872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44637.exe
        6⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26995.exe
        7⤵
        
        PID:10004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25680.exe
        7⤵
        
        PID:14924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27699.exe
        7⤵
        
        PID:4128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16065.exe
        6⤵
        
        PID:7672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20953.exe
        6⤵
        
        PID:13352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7119.exe
        6⤵
        
        PID:6604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36225.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37835.exe
        6⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36979.exe
        7⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23627.exe
        8⤵
        
        PID:7744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        8⤵
        
        PID:12204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3382.exe
        8⤵
        
        PID:7356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59350.exe
        7⤵
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8959.exe
        8⤵
        
        PID:16108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53323.exe
        8⤵
        
        PID:10080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17845.exe
        7⤵
        
        PID:12108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23994.exe
        7⤵
        
        PID:5684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51793.exe
        6⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11582.exe
        7⤵
        
        PID:14984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19774.exe
        7⤵
        
        PID:16580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65022.exe
        6⤵
        
        PID:10212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13752.exe
        6⤵
        
        PID:14364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26919.exe
        6⤵
        
        PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45546.exe
        5⤵
        
        PID:760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37503.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39631.exe
        7⤵
        
        PID:9808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2049.exe
        7⤵
        
        PID:13456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40910.exe
        7⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53590.exe
        6⤵
        
        PID:10076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-408.exe
        6⤵
        
        PID:13180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31508.exe
        6⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64991.exe
        6⤵
        
        PID:9268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47177.exe
        5⤵
        
        PID:8112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60444.exe
        6⤵
        
        PID:16440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45213.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56851.exe
        5⤵
        
        PID:6844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18453.exe
        5⤵
        
        PID:6880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23529.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22023.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16625.exe
        6⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35479.exe
        7⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8914.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48147.exe
        9⤵
        
        PID:15120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33671.exe
        9⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
        8⤵
        
        PID:10244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
        8⤵
        
        PID:14440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34523.exe
        8⤵
        
        PID:8204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44602.exe
        7⤵
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11265.exe
        7⤵
        
        PID:12292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11527.exe
        7⤵
        
        PID:13364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51053.exe
        7⤵
        
        PID:9264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
        6⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47607.exe
        7⤵
        
        PID:9608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54950.exe
        7⤵
        
        PID:13528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47407.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43346.exe
        6⤵
        
        PID:8672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49637.exe
        6⤵
        
        PID:12780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7459.exe
        6⤵
        
        PID:7260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22489.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15961.exe
        6⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15266.exe
        7⤵
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42158.exe
        7⤵
        
        PID:12332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63683.exe
        7⤵
        
        PID:8156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63766.exe
        6⤵
        
        PID:8428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37960.exe
        6⤵
        
        PID:12028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55591.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12628.exe
        5⤵
        
        PID:5620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17275.exe
        6⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6086.exe
        7⤵
        
        PID:8892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35895.exe
        8⤵
        
        PID:15028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15114.exe
        8⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14581.exe
        7⤵
        
        PID:10984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14921.exe
        7⤵
        
        PID:6208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29329.exe
        6⤵
        
        PID:7912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29626.exe
        6⤵
        
        PID:13552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23786.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59748.exe
        6⤵
        
        PID:18416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64394.exe
        5⤵
        
        PID:7776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12740.exe
        5⤵
        
        PID:6552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39785.exe
        5⤵
        
        PID:15312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64981.exe
        5⤵
        
        PID:16740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60817.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50523.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58063.exe
        6⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58359.exe
        7⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3398.exe
        8⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22993.exe
        8⤵
        
        PID:11932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48980.exe
        8⤵
        
        PID:15852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62775.exe
        8⤵
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21057.exe
        7⤵
        
        PID:8292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17845.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12894.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51793.exe
        6⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31079.exe
        7⤵
        
        PID:9936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63118.exe
        7⤵
        
        PID:13596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46255.exe
        7⤵
        
        PID:15164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65022.exe
        6⤵
        
        PID:9136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13752.exe
        6⤵
        
        PID:14372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7459.exe
        6⤵
        
        PID:1776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47518.exe
        5⤵
        
        PID:784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54851.exe
        6⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15266.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
        7⤵
        
        PID:12068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63683.exe
        7⤵
        
        PID:7240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41861.exe
        6⤵
        
        PID:7976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16884.exe
        6⤵
        
        PID:10340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19894.exe
        6⤵
        
        PID:16132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8414.exe
        6⤵
        
        PID:15792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21668.exe
        5⤵
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31271.exe
        6⤵
        
        PID:9836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63118.exe
        6⤵
        
        PID:13624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-946.exe
        6⤵
        
        PID:6744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20725.exe
        5⤵
        
        PID:9004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3472.exe
        5⤵
        
        PID:13204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14174.exe
        5⤵
        
        PID:16720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41898.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55323.exe
        5⤵
        
        PID:1528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50767.exe
        6⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3014.exe
        7⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5400.exe
        7⤵
        
        PID:12312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40315.exe
        7⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1507.exe
        7⤵
        
        PID:8464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41861.exe
        6⤵
        
        PID:7988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16884.exe
        6⤵
        
        PID:10640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43455.exe
        6⤵
        
        PID:3824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65110.exe
        5⤵
        
        PID:6596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43331.exe
        6⤵
        
        PID:9968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26169.exe
        6⤵
        
        PID:13784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35155.exe
        6⤵
        
        PID:6172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36625.exe
        5⤵
        
        PID:4664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40918.exe
        5⤵
        
        PID:13084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11550.exe
        5⤵
        
        PID:11420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7052.exe
      4⤵
      PID:5784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47363.exe
        5⤵
        
        PID:6664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35895.exe
        6⤵
        
        PID:15012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58176.exe
        6⤵
        
        PID:9096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25961.exe
        5⤵
        
        PID:10624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16360.exe
        5⤵
        
        PID:14608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32660.exe
        5⤵
        
        PID:6260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48897.exe
      4⤵
      PID:7856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27151.exe
        5⤵
        
        PID:14248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21419.exe
        5⤵
        
        PID:6724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22014.exe
      4⤵
      PID:11848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46563.exe
      4⤵
      PID:984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17474.exe
      4⤵
      PID:8992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42221.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42221.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14614.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42443.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1514.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56719.exe
        7⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6506.exe
        8⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16891.exe
        9⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15422.exe
        10⤵
        
        PID:11180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33509.exe
        10⤵
        
        PID:16728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
        9⤵
        
        PID:9160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
        9⤵
        
        PID:14480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6811.exe
        9⤵
        
        PID:16312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33117.exe
        8⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
        8⤵
        
        PID:11596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12661.exe
        8⤵
        
        PID:15580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44399.exe
        8⤵
        
        PID:16004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10251.exe
        8⤵
        
        PID:17784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48826.exe
        7⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15266.exe
        8⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46242.exe
        8⤵
        
        PID:11324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38109.exe
        8⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23884.exe
        7⤵
        
        PID:8364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56507.exe
        8⤵
        
        PID:14912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40578.exe
        8⤵
        
        PID:14064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40046.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60552.exe
        7⤵
        
        PID:16428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1249.exe
        6⤵
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32127.exe
        7⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15266.exe
        8⤵
        
        PID:7996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42158.exe
        8⤵
        
        PID:10836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17689.exe
        8⤵
        
        PID:16136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21057.exe
        7⤵
        
        PID:8280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26012.exe
        7⤵
        
        PID:11476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19702.exe
        7⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27267.exe
        7⤵
        
        PID:18368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28300.exe
        6⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55775.exe
        7⤵
        
        PID:9888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63118.exe
        7⤵
        
        PID:13616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13390.exe
        7⤵
        
        PID:16064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57098.exe
        6⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59689.exe
        6⤵
        
        PID:2344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40323.exe
        6⤵
        
        PID:1028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14321.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53787.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3154.exe
        7⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55775.exe
        8⤵
        
        PID:9864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63118.exe
        8⤵
        
        PID:13632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47407.exe
        8⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3865.exe
        7⤵
        
        PID:9108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29626.exe
        7⤵
        
        PID:13828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15618.exe
        7⤵
        
        PID:16072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8414.exe
        7⤵
        
        PID:9360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59682.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16995.exe
        7⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10549.exe
        7⤵
        
        PID:11880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36728.exe
        7⤵
        
        PID:11444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29718.exe
        7⤵
        
        PID:17652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7932.exe
        6⤵
        
        PID:9064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        6⤵
        
        PID:12580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33264.exe
        6⤵
        
        PID:16252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26727.exe
        6⤵
        
        PID:7860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51933.exe
        5⤵
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22371.exe
        6⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6906.exe
        7⤵
        
        PID:8188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22491.exe
        8⤵
        
        PID:14748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58176.exe
        8⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42158.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44607.exe
        7⤵
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57901.exe
        6⤵
        
        PID:7676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46626.exe
        6⤵
        
        PID:11616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36246.exe
        6⤵
        
        PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43486.exe
        5⤵
        
        PID:6656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23103.exe
        6⤵
        
        PID:9824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63118.exe
        6⤵
        
        PID:13640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46063.exe
        6⤵
        
        PID:4880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38677.exe
        5⤵
        
        PID:9700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49349.exe
        5⤵
        
        PID:13580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60596.exe
        5⤵
        
        PID:6908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2157.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9490.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20045.exe
        6⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18967.exe
        7⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25999.exe
        8⤵
        
        PID:13428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33671.exe
        8⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5697.exe
        7⤵
        
        PID:11316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46677.exe
        7⤵
        
        PID:15500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6205.exe
        7⤵
        
        PID:16612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20184.exe
        6⤵
        
        PID:9152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38345.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28071.exe
        6⤵
        
        PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11196.exe
        5⤵
        
        PID:3148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41935.exe
        6⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18827.exe
        7⤵
        
        PID:9816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63118.exe
        7⤵
        
        PID:13656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46255.exe
        7⤵
        
        PID:832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46574.exe
        6⤵
        
        PID:10556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36230.exe
        6⤵
        
        PID:15980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33603.exe
        6⤵
        
        PID:17600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3133.exe
        5⤵
        
        PID:7488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15519.exe
        6⤵
        
        PID:5344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25760.exe
        5⤵
        
        PID:11816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26388.exe
        5⤵
        
        PID:6020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29016.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14098.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33611.exe
        6⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23103.exe
        7⤵
        
        PID:9852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63118.exe
        7⤵
        
        PID:13648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38279.exe
        7⤵
        
        PID:16008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20563.exe
        7⤵
        
        PID:3756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
        6⤵
        
        PID:10148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16552.exe
        6⤵
        
        PID:14224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43760.exe
        6⤵
        
        PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3761.exe
        5⤵
        
        PID:7680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15540.exe
        5⤵
        
        PID:10668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44566.exe
        5⤵
        
        PID:6644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60066.exe
        5⤵
        
        PID:7000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55250.exe
      4⤵
      PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9106.exe
        5⤵
        
        PID:6992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49195.exe
        6⤵
        
        PID:7496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40289.exe
        6⤵
        
        PID:13400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26547.exe
        6⤵
        
        PID:16232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49122.exe
        5⤵
        
        PID:8604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22992.exe
        5⤵
        
        PID:14028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24284.exe
        5⤵
        
        PID:15452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38650.exe
        5⤵
        
        PID:18356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55729.exe
      4⤵
      PID:7784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61742.exe
      4⤵
      PID:7548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56851.exe
      4⤵
      PID:15232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24758.exe
      4⤵
      PID:16236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8484.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8484.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37133.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18235.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59407.exe
        6⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50767.exe
        7⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51691.exe
        8⤵
        
        PID:9616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54950.exe
        8⤵
        
        PID:13496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54506.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62002.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29626.exe
        7⤵
        
        PID:13796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11550.exe
        7⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7933.exe
        6⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23103.exe
        7⤵
        
        PID:9648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54950.exe
        7⤵
        
        PID:13504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25642.exe
        7⤵
        
        PID:13460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14860.exe
        6⤵
        
        PID:8912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12137.exe
        6⤵
        
        PID:12020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11934.exe
        6⤵
        
        PID:5836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10813.exe
        5⤵
        
        PID:6640
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6640 -s 632
        6⤵
        Program crash
        
        PID:13272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33440.exe
        5⤵
        
        PID:9256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52474.exe
        5⤵
        
        PID:1144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64213.exe
        5⤵
        
        PID:6056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52945.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14098.exe
        5⤵
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-362.exe
        6⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11338.exe
        7⤵
        
        PID:11096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55367.exe
        7⤵
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37839.exe
        7⤵
        
        PID:18320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
        6⤵
        
        PID:9760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43952.exe
        6⤵
        
        PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33117.exe
        5⤵
        
        PID:7172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe
        5⤵
        
        PID:10660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64986.exe
        5⤵
        
        PID:14772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36438.exe
        5⤵
        
        PID:6836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15717.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1094.exe
        5⤵
        
        PID:6464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4426.exe
        6⤵
        
        PID:12336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33271.exe
        6⤵
        
        PID:1680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64075.exe
        6⤵
        
        PID:16892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25961.exe
        5⤵
        
        PID:10616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16360.exe
        5⤵
        
        PID:14600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7963.exe
        5⤵
        
        PID:7508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55921.exe
      4⤵
      PID:7432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63132.exe
        5⤵
        
        PID:8184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1249.exe
      4⤵
      PID:11648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6019.exe
      4⤵
      PID:5912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29734.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29734.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42355.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45811.exe
        5⤵
        
        PID:3476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50767.exe
        6⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15266.exe
        7⤵
        
        PID:8024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42158.exe
        7⤵
        
        PID:12512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63875.exe
        7⤵
        
        PID:15848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4913.exe
        6⤵
        
        PID:7904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16884.exe
        6⤵
        
        PID:10352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35286.exe
        6⤵
        
        PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41565.exe
        5⤵
        
        PID:6716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23103.exe
        6⤵
        
        PID:9736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54950.exe
        6⤵
        
        PID:13568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1138.exe
        6⤵
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4720.exe
        5⤵
        
        PID:9596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9013.exe
        5⤵
        
        PID:13560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23994.exe
        5⤵
        
        PID:3920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52178.exe
      4⤵
      PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45479.exe
        5⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55775.exe
        6⤵
        
        PID:9880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63118.exe
        6⤵
        
        PID:13696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46063.exe
        6⤵
        
        PID:8348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
        5⤵
        
        PID:9572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
        5⤵
        
        PID:14416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53064.exe
        5⤵
        
        PID:16176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58883.exe
        5⤵
        
        PID:7660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46853.exe
      4⤵
      PID:7292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34426.exe
      4⤵
      PID:11788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7443.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33648.exe
      4⤵
      PID:9376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-560.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-560.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21691.exe
      4⤵
      PID:4788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37939.exe
        5⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35879.exe
        6⤵
        
        PID:7980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50814.exe
        6⤵
        
        PID:10508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59121.exe
        6⤵
        
        PID:15156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32660.exe
        6⤵
        
        PID:2784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18317.exe
        5⤵
        
        PID:8380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34180.exe
        5⤵
        
        PID:11832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48483.exe
        5⤵
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13759.exe
        5⤵
        
        PID:1396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28545.exe
      4⤵
      PID:6480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29055.exe
        5⤵
        
        PID:7688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40289.exe
        5⤵
        
        PID:12280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36728.exe
        5⤵
        
        PID:16316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26485.exe
        5⤵
        
        PID:17904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44881.exe
      4⤵
      PID:8916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57342.exe
      4⤵
      PID:12628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33264.exe
      4⤵
      PID:16232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55399.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37449.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37449.exe
    3⤵
    PID:440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36159.exe
      4⤵
      PID:6468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55967.exe
        5⤵
        
        PID:9540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4405.exe
        5⤵
        
        PID:3340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61714.exe
        5⤵
        
        PID:16056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27663.exe
        5⤵
        
        PID:9348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21545.exe
      4⤵
      PID:8972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35052.exe
      4⤵
      PID:13104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52120.exe
      4⤵
      PID:5640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17774.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17774.exe
    3⤵
    PID:6540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2300.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2300.exe
    3⤵
    PID:10392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56845.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56845.exe
    3⤵
    PID:14524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47935.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47935.exe
    3⤵
    PID:16920
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54910.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54910.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40441.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40441.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46143.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35811.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51291.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6122.exe
        7⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1758.exe
        8⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24779.exe
        9⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17239.exe
        10⤵
        
        PID:10720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52312.exe
        10⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57015.exe
        10⤵
        
        PID:9272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55666.exe
        9⤵
        
        PID:11916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47927.exe
        9⤵
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43397.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30864.exe
        8⤵
        
        PID:12652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19033.exe
        8⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29313.exe
        7⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57887.exe
        8⤵
        
        PID:10764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40533.exe
        8⤵
        
        PID:14960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47407.exe
        8⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56661.exe
        7⤵
        
        PID:9400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7861.exe
        7⤵
        
        PID:10760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7549.exe
        7⤵
        
        PID:16668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34881.exe
        6⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1094.exe
        7⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56455.exe
        8⤵
        
        PID:10932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46063.exe
        8⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38405.exe
        7⤵
        
        PID:10572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20444.exe
        7⤵
        
        PID:14540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46775.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62805.exe
        6⤵
        
        PID:7500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34426.exe
        6⤵
        
        PID:11796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20287.exe
        6⤵
        
        PID:8832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14897.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-481.exe
        6⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17255.exe
        7⤵
        
        PID:13832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44611.exe
        7⤵
        
        PID:16576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56357.exe
        6⤵
        
        PID:10104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62754.exe
        6⤵
        
        PID:14340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24524.exe
        6⤵
        
        PID:6160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48617.exe
        5⤵
        
        PID:5152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2526.exe
        6⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52054.exe
        7⤵
        
        PID:9912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39905.exe
        7⤵
        
        PID:13776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7003.exe
        7⤵
        
        PID:5884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24861.exe
        6⤵
        
        PID:8680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29626.exe
        6⤵
        
        PID:14212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6589.exe
        6⤵
        
        PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36662.exe
        5⤵
        
        PID:6732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57711.exe
        6⤵
        
        PID:10672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-615.exe
        6⤵
        
        PID:8588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53861.exe
        5⤵
        
        PID:9392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48197.exe
        5⤵
        
        PID:12264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64981.exe
        5⤵
        
        PID:16508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24113.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30679.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14290.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-362.exe
        7⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
        7⤵
        
        PID:10176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
        7⤵
        
        PID:14464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34523.exe
        7⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33117.exe
        6⤵
        
        PID:7388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21544.exe
        6⤵
        
        PID:11088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28062.exe
        6⤵
        
        PID:12240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61315.exe
        6⤵
        
        PID:17720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64430.exe
        5⤵
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27711.exe
        6⤵
        
        PID:7932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1805.exe
        6⤵
        
        PID:8676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19894.exe
        6⤵
        
        PID:16208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61699.exe
        6⤵
        
        PID:5380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62805.exe
        5⤵
        
        PID:7556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42594.exe
        5⤵
        
        PID:12032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7267.exe
        5⤵
        
        PID:8476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4128.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25473.exe
        5⤵
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18147.exe
        6⤵
        
        PID:9120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20916.exe
        6⤵
        
        PID:12156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52120.exe
        6⤵
        
        PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2416.exe
        5⤵
        
        PID:7408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64270.exe
        5⤵
        
        PID:2128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38494.exe
        5⤵
        
        PID:15968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1310.exe
        5⤵
        
        PID:8848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26854.exe
      4⤵
      PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33611.exe
        5⤵
        
        PID:7104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41359.exe
        6⤵
        
        PID:10860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15645.exe
        6⤵
        
        PID:15280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54698.exe
        6⤵
        
        PID:6704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
        5⤵
        
        PID:10160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
        5⤵
        
        PID:14448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40444.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe
      4⤵
      PID:7728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56415.exe
      4⤵
      PID:11940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17119.exe
      4⤵
      PID:16200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48181.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48181.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39895.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4949.exe
        5⤵
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60523.exe
        6⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18317.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26014.exe
        7⤵
        
        PID:12128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-450.exe
        7⤵
        
        PID:7524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53782.exe
        6⤵
        
        PID:1400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3472.exe
        6⤵
        
        PID:13140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7459.exe
        6⤵
        
        PID:7256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8840.exe
        5⤵
        
        PID:1636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16803.exe
        6⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43103.exe
        7⤵
        
        PID:14404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28518.exe
        7⤵
        
        PID:6176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52734.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36728.exe
        6⤵
        
        PID:14560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-445.exe
        6⤵
        
        PID:9252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45894.exe
        5⤵
        
        PID:8504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31380.exe
        5⤵
        
        PID:11844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16148.exe
        5⤵
        
        PID:6188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65402.exe
        5⤵
        
        PID:6988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31425.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22267.exe
        5⤵
        
        PID:3784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49947.exe
        6⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19507.exe
        7⤵
        
        PID:11024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62866.exe
        7⤵
        
        PID:6116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
        6⤵
        
        PID:9636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16552.exe
        6⤵
        
        PID:13452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15254.exe
        6⤵
        
        PID:6728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7845.exe
        5⤵
        
        PID:7832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9930.exe
        6⤵
        
        PID:5888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15540.exe
        5⤵
        
        PID:10696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44566.exe
        5⤵
        
        PID:14896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22842.exe
        5⤵
        
        PID:15956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9852.exe
      4⤵
      PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29527.exe
        5⤵
        
        PID:6960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47415.exe
        6⤵
        
        PID:9948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26169.exe
        6⤵
        
        PID:13736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28657.exe
        6⤵
        
        PID:6652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53782.exe
        5⤵
        
        PID:9960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-408.exe
        5⤵
        
        PID:13348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51928.exe
        5⤵
        
        PID:8228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23362.exe
      4⤵
      PID:7720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43433.exe
      4⤵
      PID:12080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63570.exe
      4⤵
      PID:6956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23294.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23294.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33729.exe
      4⤵
      PID:2000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44187.exe
        5⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28951.exe
        6⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6488 -s 488
        7⤵
        Program crash
        
        PID:9032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
        6⤵
        
        PID:10124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16552.exe
        6⤵
        
        PID:14648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20215.exe
        6⤵
        
        PID:16452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33117.exe
        5⤵
        
        PID:7200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
        5⤵
        
        PID:11572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12661.exe
        5⤵
        
        PID:15572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40315.exe
        5⤵
        
        PID:8236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21735.exe
        5⤵
        
        PID:10216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48721.exe
      4⤵
      PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35879.exe
        5⤵
        
        PID:7920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        5⤵
        
        PID:12192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22873.exe
        5⤵
        
        PID:16436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8177.exe
      4⤵
      PID:648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14084.exe
      4⤵
      PID:10388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47856.exe
      4⤵
      PID:4396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9242.exe
      4⤵
      PID:18180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42361.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42361.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25473.exe
      4⤵
      PID:5324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49563.exe
        5⤵
        
        PID:6392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27919.exe
        6⤵
        
        PID:14844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1767.exe
        6⤵
        
        PID:16932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
        5⤵
        
        PID:9024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
        5⤵
        
        PID:14472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7579.exe
        5⤵
        
        PID:16680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46853.exe
      4⤵
      PID:7224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19241.exe
      4⤵
      PID:11232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7443.exe
      4⤵
      PID:16224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26549.exe
      4⤵
      PID:7968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29281.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29281.exe
    3⤵
    PID:5164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45863.exe
      4⤵
      PID:7128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23103.exe
        5⤵
        
        PID:9672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54950.exe
        5⤵
        
        PID:13512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28657.exe
        5⤵
        
        PID:4944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
      4⤵
      PID:9200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
      4⤵
      PID:14392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52888.exe
      4⤵
      PID:16408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19310.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19310.exe
    3⤵
    PID:7820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43051.exe
      4⤵
      PID:11636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21449.exe
      4⤵
      PID:5556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57276.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57276.exe
    3⤵
    PID:11184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29985.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29985.exe
    3⤵
    PID:15128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1859.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1859.exe
    3⤵
    PID:1516
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39429.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39429.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43395.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43395.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5686.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25287.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43891.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39755.exe
        7⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62547.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45111.exe
        9⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40289.exe
        9⤵
        
        PID:13192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27315.exe
        9⤵
        
        PID:16464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36101.exe
        8⤵
        
        PID:9504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10164.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32660.exe
        8⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44986.exe
        7⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28560.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15618.exe
        7⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34859.exe
        7⤵
        
        PID:7480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60538.exe
        6⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33611.exe
        7⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24691.exe
        8⤵
        
        PID:8644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40289.exe
        8⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60179.exe
        8⤵
        
        PID:8816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13569.exe
        7⤵
        
        PID:8900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6272.exe
        7⤵
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60563.exe
        7⤵
        
        PID:6740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13412.exe
        6⤵
        
        PID:7792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21405.exe
        6⤵
        
        PID:10268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56321.exe
        6⤵
        
        PID:15260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9955.exe
        6⤵
        
        PID:7316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7497.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34327.exe
        6⤵
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33611.exe
        7⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18827.exe
        8⤵
        
        PID:9792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34337.exe
        8⤵
        
        PID:13760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40910.exe
        8⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
        7⤵
        
        PID:9732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16552.exe
        7⤵
        
        PID:14180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32852.exe
        7⤵
        
        PID:7048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65214.exe
        6⤵
        
        PID:7752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15540.exe
        6⤵
        
        PID:10704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44566.exe
        6⤵
        
        PID:15112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6589.exe
        6⤵
        
        PID:6820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8736.exe
        5⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25251.exe
        6⤵
        
        PID:1200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65178.exe
        7⤵
        
        PID:12056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60813.exe
        7⤵
        
        PID:15792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44144.exe
        7⤵
        
        PID:15972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20066.exe
        7⤵
        
        PID:3204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
        6⤵
        
        PID:9192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64180.exe
        6⤵
        
        PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15001.exe
        5⤵
        
        PID:8004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53581.exe
        5⤵
        
        PID:11200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2802.exe
        5⤵
        
        PID:3136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38093.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60035.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23419.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25443.exe
        7⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18827.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59034.exe
        8⤵
        
        PID:13608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9005.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17025.exe
        7⤵
        
        PID:10228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-408.exe
        7⤵
        
        PID:13468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6811.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61130.exe
        6⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35895.exe
        7⤵
        
        PID:15036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40386.exe
        7⤵
        
        PID:16656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52298.exe
        6⤵
        
        PID:12344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47147.exe
        6⤵
        
        PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2644.exe
        5⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31271.exe
        6⤵
        
        PID:9664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54950.exe
        6⤵
        
        PID:13536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-946.exe
        6⤵
        
        PID:3460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48930.exe
        5⤵
        
        PID:8104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4425.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38640.exe
        5⤵
        
        PID:11416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62073.exe
      4⤵
      Executes dropped EXE
      PID:3016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31395.exe
        5⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25443.exe
        6⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10134.exe
        7⤵
        
        PID:13308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41538.exe
        7⤵
        
        PID:16896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17025.exe
        6⤵
        
        PID:9980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-408.exe
        6⤵
        
        PID:11484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24284.exe
        6⤵
        
        PID:16084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26018.exe
        6⤵
        
        PID:10120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61130.exe
        5⤵
        
        PID:7664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6056.exe
        5⤵
        
        PID:10892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35362.exe
        5⤵
        
        PID:7004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49158.exe
      4⤵
      PID:2932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39963.exe
        5⤵
        
        PID:7960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        5⤵
        
        PID:10548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23802.exe
        5⤵
        
        PID:8100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16040.exe
      4⤵
      PID:8080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-865.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63570.exe
      4⤵
      PID:2616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35021.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35021.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9682.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49127.exe
        5⤵
        
        PID:1188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7238.exe
        6⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19543.exe
        7⤵
        
        PID:7760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62769.exe
        7⤵
        
        PID:11948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44399.exe
        7⤵
        
        PID:16052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9483.exe
        7⤵
        
        PID:9500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53782.exe
        6⤵
        
        PID:3108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3472.exe
        6⤵
        
        PID:9640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40323.exe
        6⤵
        
        PID:6620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55214.exe
        5⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15458.exe
        6⤵
        
        PID:7768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
        6⤵
        
        PID:12196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35286.exe
        6⤵
        
        PID:15904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18648.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22750.exe
        5⤵
        
        PID:10452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14174.exe
        5⤵
        
        PID:16644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17969.exe
      4⤵
      PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39091.exe
        5⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26995.exe
        6⤵
        
        PID:9984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26169.exe
        6⤵
        
        PID:13744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16271.exe
        6⤵
        
        PID:16392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13761.exe
        5⤵
        
        PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6272.exe
        5⤵
        
        PID:10884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41020.exe
        5⤵
        
        PID:7036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35265.exe
      4⤵
      PID:6360
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6360 -s 632
        5⤵
        Program crash
        
        PID:10040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65022.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13752.exe
      4⤵
      PID:14356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14174.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52561.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52561.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21691.exe
      4⤵
      PID:2108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63403.exe
        5⤵
        
        PID:6372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23103.exe
        6⤵
        
        PID:9684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42209.exe
        6⤵
        
        PID:14884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40444.exe
        6⤵
        
        PID:15056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25821.exe
        5⤵
        
        PID:2448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6272.exe
        5⤵
        
        PID:11064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32852.exe
        5⤵
        
        PID:432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17253.exe
      4⤵
      PID:6556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2978.exe
        5⤵
        
        PID:10792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22694.exe
        5⤵
        
        PID:12216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1819.exe
        5⤵
        
        PID:9388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59157.exe
      4⤵
      PID:9844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22418.exe
      4⤵
      PID:14300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32354.exe
      4⤵
      PID:5060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1581.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1581.exe
    3⤵
    PID:4636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25443.exe
      4⤵
      PID:6936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46419.exe
        5⤵
        
        PID:13824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44772.exe
        5⤵
        
        PID:5428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
      4⤵
      PID:9632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16552.exe
      4⤵
      PID:14256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52120.exe
      4⤵
      PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
      4⤵
      PID:9320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6528.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6528.exe
    3⤵
    PID:7736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60783.exe
      4⤵
      PID:14632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58176.exe
      4⤵
      PID:7180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60499.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60499.exe
    3⤵
    PID:11912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65059.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65059.exe
    3⤵
    PID:6496
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51298.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51298.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54695.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54695.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21743.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21691.exe
        5⤵
        
        PID:220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1758.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55775.exe
        7⤵
        
        PID:9872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63118.exe
        7⤵
        
        PID:13708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62866.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32924.exe
        6⤵
        
        PID:10032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57830.exe
        6⤵
        
        PID:13816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43455.exe
        6⤵
        
        PID:15896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12785.exe
        5⤵
        
        PID:6784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26227.exe
        6⤵
        
        PID:6328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22277.exe
        6⤵
        
        PID:13404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54698.exe
        6⤵
        
        PID:15824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33308.exe
        5⤵
        
        PID:9556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9013.exe
        5⤵
        
        PID:13520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4342.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25945.exe
      4⤵
      PID:1112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50767.exe
        5⤵
        
        PID:5500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18827.exe
        6⤵
        
        PID:9800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59034.exe
        6⤵
        
        PID:13588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59659.exe
        6⤵
        
        PID:6688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41093.exe
        5⤵
        
        PID:10052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57830.exe
        5⤵
        
        PID:13808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6589.exe
        5⤵
        
        PID:6432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1248.exe
      4⤵
      PID:6544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28894.exe
      4⤵
      PID:9060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3472.exe
      4⤵
      PID:13148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43914.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43914.exe
      4⤵
      PID:8824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38633.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38633.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57849.exe
      4⤵
      PID:6092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23103.exe
        5⤵
        
        PID:9764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54950.exe
        5⤵
        
        PID:13544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46063.exe
        5⤵
        
        PID:8232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52822.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52822.exe
      4⤵
      PID:8500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55605.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15819.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46609.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46609.exe
    3⤵
    PID:5864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-362.exe
      4⤵
      PID:3992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15526.exe
        5⤵
        
        PID:13216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40770.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41145.exe
      4⤵
      PID:10324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16552.exe
      4⤵
      PID:14060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7579.exe
      4⤵
      PID:16748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52718.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52718.exe
    3⤵
    PID:7268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25952.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25952.exe
    3⤵
    PID:11608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33795.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33795.exe
    3⤵
    PID:16196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6585.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6585.exe
    3⤵
    PID:8856
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45765.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45765.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1322.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1322.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21691.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22179.exe
        5⤵
        
        PID:3032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60767.exe
        6⤵
        
        PID:7412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14825.exe
        6⤵
        
        PID:11804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55991.exe
        6⤵
        
        PID:1344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30242.exe
        6⤵
        
        PID:18168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43397.exe
        5⤵
        
        PID:9164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51477.exe
        5⤵
        
        PID:12620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43263.exe
        5⤵
        
        PID:8344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29313.exe
      4⤵
      PID:6756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15230.exe
        5⤵
        
        PID:12252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64182.exe
        5⤵
        
        PID:16136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42254.exe
        5⤵
        
        PID:6768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe
      4⤵
      PID:9708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9013.exe
      4⤵
      PID:13472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25857.exe
      4⤵
      PID:5364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64814.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64814.exe
    3⤵
    PID:5316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49947.exe
      4⤵
      PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36315.exe
        5⤵
        
        PID:10432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35489.exe
        5⤵
        
        PID:14508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25642.exe
        5⤵
        
        PID:5560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
      4⤵
      PID:9860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
      4⤵
      PID:14488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32660.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33832.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33832.exe
    3⤵
    PID:7948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59969.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59969.exe
    3⤵
    PID:11864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28593.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28593.exe
    3⤵
    PID:11436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11925.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11925.exe
    3⤵
    PID:16128
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61814.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61814.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42111.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42111.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36979.exe
      4⤵
      PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22231.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17321.exe
        5⤵
        
        PID:12516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36065.exe
        5⤵
        
        PID:16168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32852.exe
        5⤵
        
        PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54218.exe
      4⤵
      PID:9212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58405.exe
      4⤵
      PID:12268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52120.exe
      4⤵
      PID:6140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35753.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35753.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16995.exe
      4⤵
      PID:7608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65178.exe
      4⤵
      PID:12096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60813.exe
      4⤵
      PID:15780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3194.exe
      4⤵
      PID:3084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34792.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34792.exe
    3⤵
    PID:8272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31878.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31878.exe
    3⤵
    PID:11568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3167.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3167.exe
    3⤵
    PID:2196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31889.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31889.exe
    3⤵
    PID:18392
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42455.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42455.exe
  2⤵
  PID:4348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33611.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33611.exe
    3⤵
    PID:7096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe
      4⤵
      PID:11220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40910.exe
      4⤵
      PID:8140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45422.exe
    3⤵
    PID:9920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16552.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16552.exe
    3⤵
    PID:13276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39375.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39375.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:16592
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55148.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55148.exe
  2⤵
  PID:7800
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51941.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51941.exe
  2⤵
  PID:11164
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34185.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34185.exe
  2⤵
  PID:15148
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2602.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2602.exe
  2⤵
  PID:16908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 6488 -ip 6488
1⤵
PID:4292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 6360 -ip 6360
1⤵
PID:10104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 6640 -ip 6640
1⤵
PID:12152

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-14614.exe

Filesize
468KB

MD5
73cf3d0ab6b79e8346e557cefcb8dd8c

SHA1
b6e356ce2951001c6eb87e6241e2f9cee60379e7

SHA256
41298d62256af0137f233dc4e8324dea6a09cf3149a047e35552bcb9e63af2f6

SHA512
67b8e807eb8366067b97b227ef21883e8503a1f43bc8788f23449e915a8daec9e71e8e38a22001fc23883c46c69b87563647c3d7f74b4a4393ddb2571f623e60

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17239.exe

Filesize
468KB

MD5
43dc7c68c05536a33caab6d8cf5a6697

SHA1
dcca1c2cdb190fc4a33e78fce827e0bfaf4357bd

SHA256
ff1e92e705502a3c0e6e09e4fd571b3929684734a91845862418d7b213f05868

SHA512
8c623f5dbbe33107445606591821cc70202bbd76487e09de69db19dec71f3373016708c15a7e1c36c199c86ea4c286da0eacf9203a4fb56b8ceef04499c607ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18493.exe

Filesize
468KB

MD5
819bd24cb9dbc8595fe1211c7165e0ea

SHA1
40cd7ae584cb056aefaa8367152270ebef870b52

SHA256
2eff2385ee739a3b90ce89a205635f1f6584deb3f720cc5fe3703eb0cd651093

SHA512
e2cf21e9c3a5f1ef192fadf1b1659fe141e224bcedecdaa4a32908b3d9cbe3e9d2dfa92b016519777bd504ae506c79bb89144ecfa03e738e86474792666f46b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2157.exe

Filesize
468KB

MD5
bf705cfd7cdb0e29506e2d05dab69003

SHA1
ba409d9cbb3a15307497d36764ce5c025dd52019

SHA256
381d09f543695221e8d7005fcb9d2c066236379f2e837dd182b5f7968af5fe47

SHA512
f26824417ab3f136cf20a959658c478cbd0bd36667c2bc501771be275af1ed0af01ab4f999cf4be138587abe6dd131172fa2e2305374f557f2ef3343e92fbec8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22023.exe

Filesize
468KB

MD5
dacacdfeb935f93f1ba804aa29fd3098

SHA1
38d73d07a80d9dc46c235174aa07a1c7572c8da2

SHA256
1b3bd14546f110fb89995e35ee2745733aeea8eb97c0ac9dafaf7e7ec5ca6caf

SHA512
f5337f77cb669f9cc842e7908291cb11f487b2206f539cf1106562fd566a0965499face72557d734bb961f1df59114448069586883b58d11b6ef74d7424fd846

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23294.exe

Filesize
468KB

MD5
d091324d77ed54d2093ba43c7b0d0e69

SHA1
9d913b8c61175b2394532793c8b766a267ba0cac

SHA256
e7b54126cb2ceb6ce353ca1126f313a86e05f502b3ce91fcdfcbb491dcc51af9

SHA512
b96da57df23228a78f0a7065ee91273a8a03b4d1c00cbf3df571f0e6f4adc086cce1958e58d0895c0574f885d7970aced2f8578d03ad00ce2c286baaf97e017a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23529.exe

Filesize
468KB

MD5
56abb9772d7b72d80a1c3849057fe951

SHA1
f4ff2a0ac4e8f7f2a5cef4c2098e99291d565b33

SHA256
14e99edda7e4454379d06d3883471ac46c6883bfa58301c12c7c65b12738281d

SHA512
956c6c28cb7c64e053c0cbe6668be6c5c89db85f84d23a5bd5423c37fb6077defa7b69878d3c157f34fc0c74b431d071a915067b9910e022daa839b05f7853c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24113.exe

Filesize
468KB

MD5
1b82f08c8c0545c638977709dceab402

SHA1
f3fc2c787b7ed1e7953958c7ad871341fd19e4ec

SHA256
961fa07370c63309f1f867e8284978c368cba69e93ed55488a2566ed581b8941

SHA512
1ced8b8f435861ce8b8c55dc73ac1ee75163c249bd1dea934544188b5ac86eb8a951943db673a093fe96dc495530b03e581edcdf0d2b4ddfb0aa94313387d422

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25767.exe

Filesize
468KB

MD5
147c869e407f24c7933efd687b48ff64

SHA1
8bae721161c97cbe7927ce03f3dce2083c9eb52b

SHA256
5a08797810e6c13efc76d74395ee5c5e1d620741a4772674a1a9a4ae56d80417

SHA512
5db939f9adb529b85515e82e01a1ae3a613db5c749ed7018d852856b29393abaae301bb55e83cffc43822b71c1ff39faa7377743bf533abdbb44dc243f358395

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29734.exe

Filesize
468KB

MD5
cabe2e6a334dc74c56947f655fade0dd

SHA1
fb9ddc353660ff741644a0e01f968cc83003f7c6

SHA256
bcfa0b7fc1c8496398fcaf887c161e106b2b86dbf03e9522528901cdbb1f9697

SHA512
5710bcb417be0a75729e05770bcfcf358d2ead4a04523a0bc44a2bf4d26f3f4b990dc554894147524c0e72fd0b167216e5ffda97ee89b52fa52df5255bf18d97

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35021.exe

Filesize
468KB

MD5
786927226b5c2cee9a88d84f43578fae

SHA1
c7d5972407f19692dd88194d5715937a1c488143

SHA256
d3e15e2be4af98fb4d46afffdfee52ad595da9bd24c9160d8914b760c2992f40

SHA512
3d3c50d26ac995e0814df983ef221732ec691d72a8aab84586cb89ac4cc63c3b08617a6bdcf73c6ba0cc507f59311a8cd3d92a5937f783e79ab88d52684a9320

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35811.exe

Filesize
468KB

MD5
518c7ce96a4287bd14114045349ab6e8

SHA1
81cb25a1c77c828162921efacbb5a7e3eeb421bf

SHA256
27fe88a3d8c67c11e729812108aabc628264be52db75b731996adc84c28d15a8

SHA512
ceac2a2556352e4c804817e95a864298d52d17f11cea6ac79814e93fa8a95fd1e666afea66f3c67227a39e88427eddd231d0c7fa42c894ae1bc3bdf6bc5af480

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37133.exe

Filesize
468KB

MD5
6578c68662ef4c3fd9e34ffd083c70ea

SHA1
31ba2affe5a70d38b80a35a13a6f39c9f6ecd1ca

SHA256
734d5b7419453b0930e9fc78f80cd9ebce2019d3a615f283dc1d3c7307a116d7

SHA512
fed446d5f8e4d0b795f3cc47b66073ce9baa31dc3c34cfdd08603d76537ccabc3483ae8fd4506d4742ec70a02f9644d50185ca8471530315bd0be07987e09301

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37939.exe

Filesize
468KB

MD5
1b32cf4b58405504819470b55f4be13d

SHA1
940b500e413198e8fa02a6422be667b234915c63

SHA256
175642e5c4077251ed3632104276ef7d019681874761529287c1f357ea83e4ea

SHA512
43ec02196220e56e7f916dff9871a80e3c6d4b36ed0971f9d18db83a81eef4a8fddcb35abbe18bcffb16c07614cf1b0ba77fbb83096dece5d80b4971bffda7a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38359.exe

Filesize
468KB

MD5
5e1df2b930b6539208aebafae06853e8

SHA1
5ac29b6dbcaf1d0e76e7214a5882349df87b317e

SHA256
9cc4acde87046f4f853851d6d22bb9bf59fc299f799d36257577995ea451cb85

SHA512
b6668ff015fa7d05e1dfbd640b01603e3ab3dd101aea2b400677f983551941a43c23c855ac5e5306370549e455f3a3c66707a6f49b2c9edfefa54c60e531cf52

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39429.exe

Filesize
468KB

MD5
4ff88585765987c5559f03c68ef2e8f8

SHA1
512b88f334f1171b66fe6ef8e3627465a8cf1ecf

SHA256
edd7327c7c88d2181f718ff75d70e39c1b473b9f69e0af9afa8fce867eef2f15

SHA512
a2991068d966b70830d95411a12ac8dc55dfebd56ca995f9a097c7d3d52b399cdbd3d4e0828758c0c7343ff800f3d4a051c4b82f5fd1068438e3712a06c564db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39895.exe

Filesize
468KB

MD5
cc594e4296eb02111cb592b3d13a89b2

SHA1
0fabcb651966d267fe0d1fc1a07c3527f28434b5

SHA256
2e7a0c1883a262d1be3556a69c13f3c8bc4167c406b11f59f70b5641aba98971

SHA512
6a37fb5aff5b935b0875b2550d459c79243fb76279ad88436a6288e2d8e228ccf2edbcbe728e960b372bd04da6624508c38a797e24fb3ec91d73b908c6f85d2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40441.exe

Filesize
468KB

MD5
83c683e4bf73338d54011001607281f7

SHA1
4c314275c2cef7717999dff26642b7fe82dc9837

SHA256
25c7b0ca91fad3a2c8b364c5aa488eec08fee3db07b9fc273cad9b952261ea3d

SHA512
3dc1f1a64f2dffce4ade2fa4bbc0ec9ac61146288934f515f29dbf94a1d989bd353edc80ff265107349d1ea9f343ac1eac6b4ff49b76611215aaad8b2e67ac15

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42221.exe

Filesize
468KB

MD5
113e5dd14364f9bd2706f1406ea853fc

SHA1
19a98dd4f10925f4242d8c2b394a560939488e06

SHA256
8c34fb20d77b90595f75efb9d83e3f4d120042bc8ccb72e8c94f77277965065b

SHA512
17d4b65c84c2606347c5a9a51f9f91d9d00297b1743a98b20070ff30f232a6946cfe6b4ac28e584cf9a5f402f556e02a2c433cbade72f06c9965d190c44a4cf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42443.exe

Filesize
468KB

MD5
b1624dfa9eba2c65f3762224fb164bd6

SHA1
22aed1bf110d9d980bc21bad50a4d7c17545a438

SHA256
204c602f2a4c7ea9f955282c36f6fc864940f7366e2d9345279136f72cc59466

SHA512
55f16f2e78cc1b063a31dd9ee875c3cb283c18979eb1766b7c94154eb53e441f08a91ab0e624b500ade79c0b628efe7853b5817047b2bc332e5d756cd9b99c5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43395.exe

Filesize
468KB

MD5
63d519dfc2c238ab9952559996bd3171

SHA1
86c6feb842e2623cf7619215dd0ca445fd64dfa7

SHA256
8bb56d8111531bafc286c4b39fc753ea844c9a6141214c972780ce20cd36d299

SHA512
41e50b737b296f3187d8a20ebb56a766d89520e36dbbfaa896df2739b5e7db0da96af76b7d88dad90bb963ab06bb673fccd4ff0d7ca4bf3ebdc29d1a63f4996b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43891.exe

Filesize
468KB

MD5
b5210c44bc99d4ba213ec27b8c4810ed

SHA1
daebd3a1e0669a6ac694d8cc48f448caa03b82ef

SHA256
ba78635ec252a7ec24d536e52326113c3fc425ba90a18e23237f20d683b87775

SHA512
b59649b1f0376e7b1a7d97d28ccffdca30899fbfabdaf558469ee27fcb38730db9ea94813c07dddcb9724dce0f692ccac990a2913b45ca266492ad41649da7e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45765.exe

Filesize
468KB

MD5
ead0f6b339e8ab5f5d4bf797f6414bf9

SHA1
54685e69f5220f251fc752dc575abd641c57aaa6

SHA256
6f05c54b681581da49a47c8acd0f93b215afd32ff0e43be7362cef2ec766e681

SHA512
46c18f90fb9544fc07f7974338c102bce0ea74a154b0bd85883e5517f94656f4f38822b829ccf60969dd1f55d5859c9150f79ff0c14c4110bf71d31586793315

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46143.exe

Filesize
468KB

MD5
3f53028ab1773ab5d46cbc59f4029c41

SHA1
ae3e0fbbf8c6675c94d183abc4b90ad69f53842e

SHA256
773a651cea979083ba533cc325d6cdcd02449cff02752c5427255fc97e4f0c5c

SHA512
819b1bcd10ded60b12ca78cb9ba0a0fba77219a191ba3b81d1591c5fd932db91483c89c830e2c59caf43edce3202bdeab9e4580e24d81fdcdd80f89cf157784e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48181.exe

Filesize
468KB

MD5
812cebde254dc4650db75129f309923a

SHA1
c4815fdaff6c5e4eeab06b0e6535c0cad49259ca

SHA256
c13a51ed7137b5b2ff225ae05c80742ee2ab56baf93b56e538bf8bdd27a707a6

SHA512
7cd2af385548281ccd551e8c4c7fae8498f8e56f46fc7810273f560c818373fa5416e14307b1e95117d5545782a7f27c0701b0ba53624525479610a531ee1a0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51298.exe

Filesize
468KB

MD5
056b4cb1c9ae531cb7c5589d5b06aab3

SHA1
38d6a501188fde07f74daf650362bcbdee803786

SHA256
c69e7eb2fcd4e3222299e783349a10b9e8a9a3571a0741f3dbd290213a1f9719

SHA512
5f0564d53fdd5ff49b73db6d5a00d98b7ba53cc797265f100335a91e741a9b91c971cc4375bf7c4b28f55c4d3e6985b1bf81dcdfdc9216198946de9ebe8bc182

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53919.exe

Filesize
468KB

MD5
933dfeb2a82d600cb140eaad6fc026ec

SHA1
bbc6831eca02c0656e6c899b0c5441be2ec7cf6d

SHA256
96e310d53c9908f6f23f439d7a61d93274d8b54c0e35fc72cca2f3b2f0b7dc1a

SHA512
644f9b51756b2faade647bf814ea68f8dfcab232c4bbd67b9bac37420a00743272ccba46b12f556e8687f0fd9e3ab491903735931715eda293c1aabb61ccb24f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54695.exe

Filesize
468KB

MD5
219d04984a8c6f3fb6a01ba92d3afd59

SHA1
69a466acba8f496a497cb4552affceccf1c2f673

SHA256
2f283f3129d416ec7034902cafeefcf3b0a8535821c5f0fcac3ebae22eadcdfb

SHA512
2bc67af889bbfd86423c53cd2f9ee6cd94256d368de52c312bc3f5fcaa27c6b90a0b4ea29b4f957a66d2d555324634301a416b1dcbf3bfad571e99e07e89ace1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54910.exe

Filesize
468KB

MD5
f8de45617e87300ef5dad3fbadf02975

SHA1
52709a528e307463c650766eb211876701a1ca82

SHA256
4c151b0c1630888d7a0c1b22136ac1a93a0330de0ac441b9307153310a2d705b

SHA512
40e8ce1d59c7c3418cfbdf2562367968b7dba64d2d6ab08a1812e333fa1231d59ecda49910a211286e8190f992ba672f2f76c915812cfa93424f4d64c594110b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5686.exe

Filesize
468KB

MD5
78c1af0ff4d9a18c007da278d1e78ca2

SHA1
de51352b657982f6e7e272a7212705a8da3d95d1

SHA256
6acc34873c214cd1e90656e4d35528699d6371cb7c27d872e7ba01319746ed7e

SHA512
e2d42316532495fa965dff8696fc43062c15d9972fdf5954629970b9e469cac1d4e64b9ee05cddeee4646ebae853dcb9ce00e203a285000ee70fad1e9b6fb0a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60447.exe

Filesize
468KB

MD5
5186fbd60a8922bd7ce0c319556ed571

SHA1
0b5b9508af0f9b500c4a066af9526f8895d1d2d3

SHA256
491c460d5cc81fb72592ac8462ae8fdbdcc8d5213cf249b868492b0523f676da

SHA512
a97419bfef33d78535ca4006dcbc776614ad01ba52345e9ee6f428c4c2b94e83e22275695842b18671a26138679ab7f3427b4b76ef5871205cf6605fb88504fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60817.exe

Filesize
468KB

MD5
205fe0c88dbec59526a271683af4c2a0

SHA1
6b2d05475086ecf5e097ca1955729cf2cb0cdd56

SHA256
312059865a551b9f00e473f25f74a3ac76a35f1d91371f8212d1570c57a3787b

SHA512
2ffcf238f51cf1bdeda93fca743567fd57836d929198e3bbedef8797caaa43d09aba02819fb2255712370311f8168cc7d6f5b66eb510629eaba2f79d030ad923

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64007.exe

Filesize
468KB

MD5
e5566020ac5679a360a4de719e32d9ff

SHA1
bb08ca9cbdf943bcb57756c3d7625743966e9839

SHA256
b0020881aacfe2fdb914e9282f06bde01295671062c1a38eaa919c1c6954b42c

SHA512
6af2bbd24e824c970dace7aa9fe7b36493781397c03b1dc6cd59fc324b1d342d6fb167f3dfefeb81529ebf827b03ba49b52e81251e19a1d49b9a88e5db25f01d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8484.exe

Filesize
468KB

MD5
982eb8a0ecc001e6b3a4cb8a6bebd401

SHA1
54f6001f7e0ba1c6718dc454c0ae0b8889c3fb56

SHA256
3b879960f09a3fe318c4c12345cb59c82f028716200caf32a8401fb5b2fff200

SHA512
2e8336fa835f00b017041987c4f3ea303c9dc18a8ead956719c0629328c86544abdc630d19d54aa6a42d44190fee08acc49902e1670fbb4b999d8aed45dbc604

Download Submit
memory/392-259-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/404-296-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/468-458-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/512-203-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/692-513-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/760-510-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/784-532-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/976-355-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1032-257-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1112-504-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1188-445-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1204-302-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1256-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1276-42-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1360-239-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1380-99-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1488-282-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1504-316-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1528-531-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1540-326-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1764-303-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1772-407-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1920-50-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1972-412-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1976-78-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2000-433-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2068-113-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2272-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2284-529-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2300-86-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2312-474-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2500-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2652-364-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2664-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2692-158-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2712-208-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2752-83-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2780-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2852-530-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2944-178-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2984-306-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3016-383-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3020-280-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3060-307-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3168-359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3248-247-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3252-423-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3476-511-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3480-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3488-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3508-443-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3544-377-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3676-473-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3684-544-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3704-209-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3708-475-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3724-422-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3784-562-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4004-202-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4076-31-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4104-220-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4140-301-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4156-140-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4224-177-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4244-139-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4248-265-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4280-238-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4296-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4360-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4364-563-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4376-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4404-226-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4432-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4436-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4484-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4504-105-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4532-375-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4568-391-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4572-283-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4636-543-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4644-503-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4660-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4732-57-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4736-138-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4756-89-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4772-154-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4788-457-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4896-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4924-502-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4964-161-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5020-421-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5028-176-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5032-41-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5048-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5084-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5152-564-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads