43fdf717f39b85884b04281c41e59d718dc295070f1f70b2e8a01eccdb5317e0

Analysis

max time kernel
150s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-09-2024 20:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

43fdf717f39b85884b04281c41e59d718dc295070f1f70b2e8a01eccdb5317e0.exe
Size

468KB
MD5

92f287e6c04197a956357b95ef1e79bf
SHA1

5c7c4bdf8cb077ac3b2f8bfeecc6464e70429054
SHA256

43fdf717f39b85884b04281c41e59d718dc295070f1f70b2e8a01eccdb5317e0
SHA512

fd513328c7d2edae79a7b9aca72e01b3b626d2c1e39428151ada01946e4add3968b640289a8a64da4ba88395094445a4c6fdecf998ee7bd161a6a6eb5cfb68f7
SSDEEP

3072:abXfog5+Pb8UwaYjPzijTf8/ECheZ4pfhdHeZVrUjLWNyrITkayL:abPohYUwbPejTfZEq0jLq0ITk

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3552	Unicorn-18715.exe
3296	Unicorn-3338.exe
2044	Unicorn-20421.exe
2656	Unicorn-33079.exe
2976	Unicorn-17297.exe
3764	Unicorn-8574.exe
932	Unicorn-2444.exe
1688	Unicorn-2113.exe
1840	Unicorn-41029.exe
4688	Unicorn-51890.exe
948	Unicorn-61449.exe
3260	Unicorn-4080.exe
3288	Unicorn-63487.exe
1792	Unicorn-3815.exe
2232	Unicorn-32031.exe
4936	Unicorn-38153.exe
2780	Unicorn-42145.exe
620	Unicorn-1112.exe
2120	Unicorn-60519.exe
3352	Unicorn-35923.exe
2160	Unicorn-30255.exe
4436	Unicorn-41953.exe
2028	Unicorn-17759.exe
2376	Unicorn-28885.exe
2876	Unicorn-39821.exe
2296	Unicorn-46037.exe
4136	Unicorn-7142.exe
4900	Unicorn-28907.exe
4576	Unicorn-19347.exe
1584	Unicorn-47116.exe
224	Unicorn-8486.exe
2620	Unicorn-17209.exe
3336	Unicorn-37075.exe
3520	Unicorn-45143.exe
3248	Unicorn-8294.exe
4960	Unicorn-2840.exe
3944	Unicorn-6924.exe
4840	Unicorn-15092.exe
4872	Unicorn-25953.exe
1436	Unicorn-41635.exe
2040	Unicorn-56488.exe
2896	Unicorn-10816.exe
3168	Unicorn-10816.exe
3744	Unicorn-45362.exe
3008	Unicorn-1065.exe
3748	Unicorn-20931.exe
5000	Unicorn-12000.exe
668	Unicorn-63909.exe
4516	Unicorn-510.exe
1932	Unicorn-37359.exe
2284	Unicorn-48749.exe
4624	Unicorn-12762.exe
4876	Unicorn-30421.exe
1864	Unicorn-54350.exe
316	Unicorn-42311.exe
2360	Unicorn-21699.exe
3704	Unicorn-38127.exe
2552	Unicorn-24391.exe
3948	Unicorn-28497.exe
3620	Unicorn-42887.exe
4332	Unicorn-60599.exe
3912	Unicorn-57085.exe
4068	Unicorn-18191.exe
2948	Unicorn-18191.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db-wal	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db-shm	OfficeClickToRun.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
16000	15624	WerFault.exe	733
15984	14740	WerFault.exe	704
10152	3572	WerFault.exe	920
9336	856	WerFault.exe	824
18548	1176	WerFault.exe	973

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34197.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47116.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30267.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22829.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1013.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33955.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9197.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19402.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42311.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57085.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23920.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3525.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62845.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31894.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3520.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47459.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13328.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62046.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62377.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51802.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24595.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62360.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43031.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49929.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13971.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17283.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48092.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33489.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26999.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6374.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42634.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3525.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63429.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16733.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9197.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7606.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57938.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12129.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49848.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46400.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56374.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2653.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25093.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63429.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17476.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40941.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19727.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20359.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58014.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47518.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17297.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51735.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1288.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19422.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49929.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31512.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 44 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "1"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16436	dwm.exe
Token: SeChangeNotifyPrivilege	16436	dwm.exe
Token: 33	16436	dwm.exe
Token: SeIncBasePriorityPrivilege	16436	dwm.exe
Token: SeCreateGlobalPrivilege	7716	dwm.exe
Token: SeChangeNotifyPrivilege	7716	dwm.exe
Token: 33	7716	dwm.exe
Token: SeIncBasePriorityPrivilege	7716	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2132	43fdf717f39b85884b04281c41e59d718dc295070f1f70b2e8a01eccdb5317e0.exe
3552	Unicorn-18715.exe
3296	Unicorn-3338.exe
2044	Unicorn-20421.exe
2656	Unicorn-33079.exe
932	Unicorn-2444.exe
3764	Unicorn-8574.exe
2976	Unicorn-17297.exe
1688	Unicorn-2113.exe
1840	Unicorn-41029.exe
4688	Unicorn-51890.exe
948	Unicorn-61449.exe
1792	Unicorn-3815.exe
3288	Unicorn-63487.exe
3260	Unicorn-4080.exe
2232	Unicorn-32031.exe
4936	Unicorn-38153.exe
2780	Unicorn-42145.exe
620	Unicorn-1112.exe
3352	Unicorn-35923.exe
2120	Unicorn-60519.exe
2160	Unicorn-30255.exe
4436	Unicorn-41953.exe
2028	Unicorn-17759.exe
2376	Unicorn-28885.exe
4136	Unicorn-7142.exe
2876	Unicorn-39821.exe
2296	Unicorn-46037.exe
4576	Unicorn-19347.exe
4900	Unicorn-28907.exe
1584	Unicorn-47116.exe
224	Unicorn-8486.exe
3336	Unicorn-37075.exe
2620	Unicorn-17209.exe
3520	Unicorn-45143.exe
3248	Unicorn-8294.exe
4840	Unicorn-15092.exe
3944	Unicorn-6924.exe
4872	Unicorn-25953.exe
4960	Unicorn-2840.exe
1436	Unicorn-41635.exe
2040	Unicorn-56488.exe
3168	Unicorn-10816.exe
2896	Unicorn-10816.exe
3744	Unicorn-45362.exe
3748	Unicorn-20931.exe
668	Unicorn-63909.exe
5000	Unicorn-12000.exe
1932	Unicorn-37359.exe
3008	Unicorn-1065.exe
4516	Unicorn-510.exe
2284	Unicorn-48749.exe
4624	Unicorn-12762.exe
4876	Unicorn-30421.exe
1864	Unicorn-54350.exe
316	Unicorn-42311.exe
2360	Unicorn-21699.exe
2552	Unicorn-24391.exe
3704	Unicorn-38127.exe
3948	Unicorn-28497.exe
3620	Unicorn-42887.exe
4332	Unicorn-60599.exe
4068	Unicorn-18191.exe
2948	Unicorn-18191.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 3552	2132	43fdf717f39b85884b04281c41e59d718dc295070f1f70b2e8a01eccdb5317e0.exe	84
PID 2132 wrote to memory of 3552	2132	43fdf717f39b85884b04281c41e59d718dc295070f1f70b2e8a01eccdb5317e0.exe	84
PID 2132 wrote to memory of 3552	2132	43fdf717f39b85884b04281c41e59d718dc295070f1f70b2e8a01eccdb5317e0.exe	84
PID 3552 wrote to memory of 3296	3552	Unicorn-18715.exe	85
PID 3552 wrote to memory of 3296	3552	Unicorn-18715.exe	85
PID 3552 wrote to memory of 3296	3552	Unicorn-18715.exe	85
PID 2132 wrote to memory of 2044	2132	43fdf717f39b85884b04281c41e59d718dc295070f1f70b2e8a01eccdb5317e0.exe	86
PID 2132 wrote to memory of 2044	2132	43fdf717f39b85884b04281c41e59d718dc295070f1f70b2e8a01eccdb5317e0.exe	86
PID 2132 wrote to memory of 2044	2132	43fdf717f39b85884b04281c41e59d718dc295070f1f70b2e8a01eccdb5317e0.exe	86
PID 3296 wrote to memory of 2656	3296	Unicorn-3338.exe	91
PID 3296 wrote to memory of 2656	3296	Unicorn-3338.exe	91
PID 3296 wrote to memory of 2656	3296	Unicorn-3338.exe	91
PID 3552 wrote to memory of 2976	3552	Unicorn-18715.exe	92
PID 3552 wrote to memory of 2976	3552	Unicorn-18715.exe	92
PID 3552 wrote to memory of 2976	3552	Unicorn-18715.exe	92
PID 2044 wrote to memory of 3764	2044	Unicorn-20421.exe	93
PID 2044 wrote to memory of 3764	2044	Unicorn-20421.exe	93
PID 2044 wrote to memory of 3764	2044	Unicorn-20421.exe	93
PID 2132 wrote to memory of 932	2132	43fdf717f39b85884b04281c41e59d718dc295070f1f70b2e8a01eccdb5317e0.exe	94
PID 2132 wrote to memory of 932	2132	43fdf717f39b85884b04281c41e59d718dc295070f1f70b2e8a01eccdb5317e0.exe	94
PID 2132 wrote to memory of 932	2132	43fdf717f39b85884b04281c41e59d718dc295070f1f70b2e8a01eccdb5317e0.exe	94
PID 2044 wrote to memory of 1688	2044	Unicorn-20421.exe	96
PID 2044 wrote to memory of 1688	2044	Unicorn-20421.exe	96
PID 2044 wrote to memory of 1688	2044	Unicorn-20421.exe	96
PID 2656 wrote to memory of 1840	2656	Unicorn-33079.exe	97
PID 2656 wrote to memory of 1840	2656	Unicorn-33079.exe	97
PID 2656 wrote to memory of 1840	2656	Unicorn-33079.exe	97
PID 3296 wrote to memory of 4688	3296	Unicorn-3338.exe	98
PID 3296 wrote to memory of 4688	3296	Unicorn-3338.exe	98
PID 3296 wrote to memory of 4688	3296	Unicorn-3338.exe	98
PID 2976 wrote to memory of 948	2976	Unicorn-17297.exe	99
PID 2976 wrote to memory of 948	2976	Unicorn-17297.exe	99
PID 2976 wrote to memory of 948	2976	Unicorn-17297.exe	99
PID 932 wrote to memory of 3260	932	Unicorn-2444.exe	100
PID 932 wrote to memory of 3260	932	Unicorn-2444.exe	100
PID 932 wrote to memory of 3260	932	Unicorn-2444.exe	100
PID 3552 wrote to memory of 3288	3552	Unicorn-18715.exe	101
PID 3552 wrote to memory of 3288	3552	Unicorn-18715.exe	101
PID 3552 wrote to memory of 3288	3552	Unicorn-18715.exe	101
PID 2132 wrote to memory of 1792	2132	43fdf717f39b85884b04281c41e59d718dc295070f1f70b2e8a01eccdb5317e0.exe	102
PID 2132 wrote to memory of 1792	2132	43fdf717f39b85884b04281c41e59d718dc295070f1f70b2e8a01eccdb5317e0.exe	102
PID 2132 wrote to memory of 1792	2132	43fdf717f39b85884b04281c41e59d718dc295070f1f70b2e8a01eccdb5317e0.exe	102
PID 1688 wrote to memory of 2232	1688	Unicorn-2113.exe	105
PID 1688 wrote to memory of 2232	1688	Unicorn-2113.exe	105
PID 1688 wrote to memory of 2232	1688	Unicorn-2113.exe	105
PID 2044 wrote to memory of 4936	2044	Unicorn-20421.exe	106
PID 2044 wrote to memory of 4936	2044	Unicorn-20421.exe	106
PID 2044 wrote to memory of 4936	2044	Unicorn-20421.exe	106
PID 4688 wrote to memory of 2780	4688	Unicorn-51890.exe	107
PID 4688 wrote to memory of 2780	4688	Unicorn-51890.exe	107
PID 4688 wrote to memory of 2780	4688	Unicorn-51890.exe	107
PID 1840 wrote to memory of 620	1840	Unicorn-41029.exe	108
PID 1840 wrote to memory of 620	1840	Unicorn-41029.exe	108
PID 1840 wrote to memory of 620	1840	Unicorn-41029.exe	108
PID 3296 wrote to memory of 2120	3296	Unicorn-3338.exe	109
PID 3296 wrote to memory of 2120	3296	Unicorn-3338.exe	109
PID 3296 wrote to memory of 2120	3296	Unicorn-3338.exe	109
PID 948 wrote to memory of 3352	948	Unicorn-61449.exe	110
PID 948 wrote to memory of 3352	948	Unicorn-61449.exe	110
PID 948 wrote to memory of 3352	948	Unicorn-61449.exe	110
PID 2976 wrote to memory of 2160	2976	Unicorn-17297.exe	111
PID 2976 wrote to memory of 2160	2976	Unicorn-17297.exe	111
PID 2976 wrote to memory of 2160	2976	Unicorn-17297.exe	111
PID 3260 wrote to memory of 4436	3260	Unicorn-4080.exe	112

C:\Users\Admin\AppData\Local\Temp\43fdf717f39b85884b04281c41e59d718dc295070f1f70b2e8a01eccdb5317e0.exe
"C:\Users\Admin\AppData\Local\Temp\43fdf717f39b85884b04281c41e59d718dc295070f1f70b2e8a01eccdb5317e0.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18715.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18715.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3338.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3338.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33079.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41029.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1112.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8294.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57085.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19727.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe
        10⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37833.exe
        11⤵
        
        PID:11060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40035.exe
        11⤵
        
        PID:15660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9197.exe
        10⤵
        
        PID:11496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49080.exe
        10⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24085.exe
        9⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15414.exe
        10⤵
        
        PID:14740
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14740 -s 464
        11⤵
        Program crash
        
        PID:15984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53379.exe
        10⤵
        
        PID:16928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24686.exe
        9⤵
        
        PID:11984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34648.exe
        9⤵
        
        PID:16828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6851.exe
        8⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16733.exe
        9⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55705.exe
        10⤵
        
        PID:11656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22969.exe
        10⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9197.exe
        9⤵
        
        PID:11544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34882.exe
        9⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11178.exe
        8⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2228.exe
        9⤵
        
        PID:11788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32723.exe
        9⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27443.exe
        9⤵
        
        PID:18912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30552.exe
        8⤵
        
        PID:11916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8016.exe
        8⤵
        
        PID:16140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2409.exe
        7⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1252.exe
        8⤵
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1382.exe
        9⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49929.exe
        10⤵
        
        PID:9544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18353.exe
        10⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33955.exe
        9⤵
        
        PID:9860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55525.exe
        9⤵
        
        PID:16188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62360.exe
        9⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33281.exe
        9⤵
        
        PID:19016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25647.exe
        8⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13878.exe
        9⤵
        
        PID:13168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49047.exe
        9⤵
        
        PID:15388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19232.exe
        8⤵
        
        PID:12244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13351.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24094.exe
        7⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27231.exe
        8⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30498.exe
        8⤵
        
        PID:12076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18737.exe
        8⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25980.exe
        7⤵
        
        PID:8580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61133.exe
        8⤵
        
        PID:13136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43017.exe
        8⤵
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61741.exe
        7⤵
        
        PID:12504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34089.exe
        7⤵
        
        PID:16428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25953.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17999.exe
        7⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57251.exe
        8⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51735.exe
        9⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55705.exe
        10⤵
        
        PID:11620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26652.exe
        10⤵
        
        PID:17772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58014.exe
        9⤵
        
        PID:12436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        9⤵
        
        PID:13760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33021.exe
        8⤵
        
        PID:8544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20101.exe
        9⤵
        
        PID:12572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8093.exe
        9⤵
        
        PID:16460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25454.exe
        8⤵
        
        PID:12796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18353.exe
        8⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32471.exe
        7⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11252.exe
        8⤵
        
        PID:8988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48793.exe
        9⤵
        
        PID:9724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42907.exe
        9⤵
        
        PID:13376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37152.exe
        9⤵
        
        PID:15520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3525.exe
        8⤵
        
        PID:12376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2556.exe
        8⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43081.exe
        8⤵
        
        PID:19288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37760.exe
        7⤵
        
        PID:9968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49607.exe
        7⤵
        
        PID:4276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20612.exe
        6⤵
        
        PID:640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33131.exe
        7⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57573.exe
        8⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13328.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:10536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40872.exe
        9⤵
        
        PID:16112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51794.exe
        9⤵
        
        PID:17268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44008.exe
        8⤵
        
        PID:11364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
        8⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
        8⤵
        
        PID:212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13971.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19762.exe
        8⤵
        
        PID:14448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60147.exe
        8⤵
        
        PID:19304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24686.exe
        7⤵
        
        PID:11968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63429.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21729.exe
        6⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1076.exe
        7⤵
        
        PID:10892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22969.exe
        7⤵
        
        PID:13804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60147.exe
        7⤵
        
        PID:18408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63557.exe
        6⤵
        
        PID:9324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50017.exe
        6⤵
        
        PID:7404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45143.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18191.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1013.exe
        7⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18461.exe
        8⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64401.exe
        9⤵
        
        PID:15424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38.exe
        9⤵
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59617.exe
        9⤵
        
        PID:16440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3525.exe
        8⤵
        
        PID:12920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22969.exe
        8⤵
        
        PID:13848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40125.exe
        7⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8735.exe
        7⤵
        
        PID:14252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14067.exe
        7⤵
        
        PID:17392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8413.exe
        6⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8180.exe
        7⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37833.exe
        8⤵
        
        PID:11108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40872.exe
        8⤵
        
        PID:15916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25235.exe
        8⤵
        
        PID:17396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8045.exe
        7⤵
        
        PID:10724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13351.exe
        7⤵
        
        PID:14684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37821.exe
        6⤵
        
        PID:7368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25098.exe
        6⤵
        
        PID:12684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7293.exe
        7⤵
        
        PID:16844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47092.exe
        6⤵
        
        PID:5244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33281.exe
        6⤵
        
        PID:18816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34262.exe
        5⤵
        
        PID:1772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
        6⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe
        7⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64044.exe
        8⤵
        
        PID:10908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
        8⤵
        
        PID:13772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
        8⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-645.exe
        7⤵
        
        PID:9380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
        7⤵
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24085.exe
        6⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56063.exe
        7⤵
        
        PID:13952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42305.exe
        7⤵
        
        PID:1220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2745.exe
        7⤵
        
        PID:8916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24686.exe
        6⤵
        
        PID:11924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19381.exe
        6⤵
        
        PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16032.exe
        5⤵
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13198.exe
        6⤵
        
        PID:7216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48642.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26489.exe
        6⤵
        
        PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49761.exe
        5⤵
        
        PID:9476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21020.exe
        5⤵
        
        PID:13972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57141.exe
        5⤵
        
        PID:5508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51890.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42145.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37075.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18191.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1013.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51735.exe
        9⤵
        
        PID:7796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43017.exe
        10⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59617.exe
        10⤵
        
        PID:9060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58014.exe
        9⤵
        
        PID:11848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19422.exe
        9⤵
        
        PID:15736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46757.exe
        8⤵
        
        PID:8552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40382.exe
        9⤵
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19067.exe
        8⤵
        
        PID:12636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30273.exe
        8⤵
        
        PID:17076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4329.exe
        7⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28601.exe
        8⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49929.exe
        9⤵
        
        PID:9508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17476.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
        9⤵
        
        PID:18724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2207.exe
        8⤵
        
        PID:10076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57938.exe
        8⤵
        
        PID:14116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47860.exe
        8⤵
        
        PID:17240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37821.exe
        7⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40382.exe
        8⤵
        
        PID:13176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43081.exe
        8⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25098.exe
        7⤵
        
        PID:12256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56068.exe
        7⤵
        
        PID:16716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14661.exe
        6⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28279.exe
        7⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12.exe
        8⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37101.exe
        9⤵
        
        PID:10084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45722.exe
        9⤵
        
        PID:17104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12129.exe
        8⤵
        
        PID:9964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63429.exe
        8⤵
        
        PID:16060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5803.exe
        7⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30781.exe
        8⤵
        
        PID:8408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35569.exe
        7⤵
        
        PID:12192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7284.exe
        7⤵
        
        PID:16088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63429.exe
        7⤵
        
        PID:15868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18832.exe
        6⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26219.exe
        7⤵
        
        PID:9284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9555.exe
        7⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39505.exe
        7⤵
        
        PID:15632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9425.exe
        6⤵
        
        PID:9484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47133.exe
        6⤵
        
        PID:14384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43210.exe
        6⤵
        
        PID:5672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17209.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42887.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25709.exe
        7⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41979.exe
        8⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61133.exe
        9⤵
        
        PID:13148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17823.exe
        9⤵
        
        PID:13932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43081.exe
        9⤵
        
        PID:9224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3525.exe
        8⤵
        
        PID:12240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18892.exe
        8⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11344.exe
        7⤵
        
        PID:9068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39462.exe
        7⤵
        
        PID:14172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19422.exe
        7⤵
        
        PID:15216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61314.exe
        6⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe
        7⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6374.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36828.exe
        8⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9197.exe
        7⤵
        
        PID:11504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19422.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29844.exe
        6⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
        7⤵
        
        PID:11584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23846.exe
        7⤵
        
        PID:4560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30552.exe
        6⤵
        
        PID:12012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58093.exe
        6⤵
        
        PID:16452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28396.exe
        5⤵
        
        PID:2724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46307.exe
        6⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33811.exe
        7⤵
        
        PID:8976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54672.exe
        7⤵
        
        PID:14228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3086.exe
        7⤵
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53992.exe
        6⤵
        
        PID:9572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64899.exe
        6⤵
        
        PID:14372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17816.exe
        6⤵
        
        PID:11576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47194.exe
        5⤵
        
        PID:7012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44055.exe
        6⤵
        
        PID:11016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57139.exe
        6⤵
        
        PID:17020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29637.exe
        5⤵
        
        PID:11876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44203.exe
        5⤵
        
        PID:2400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60519.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2840.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30251.exe
        6⤵
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27833.exe
        7⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41979.exe
        8⤵
        
        PID:9136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54672.exe
        8⤵
        
        PID:14208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
        8⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31894.exe
        7⤵
        
        PID:10276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9962.exe
        7⤵
        
        PID:4132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39845.exe
        6⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49929.exe
        7⤵
        
        PID:10356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
        7⤵
        
        PID:13788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
        7⤵
        
        PID:18664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13805.exe
        6⤵
        
        PID:11732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20491.exe
        6⤵
        
        PID:2152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
        6⤵
        
        PID:18752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6877.exe
        5⤵
        
        PID:2612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28663.exe
        6⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59711.exe
        7⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15118.exe
        8⤵
        
        PID:9708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18353.exe
        8⤵
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9197.exe
        7⤵
        
        PID:11528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18353.exe
        7⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24085.exe
        6⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26323.exe
        7⤵
        
        PID:12052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48170.exe
        7⤵
        
        PID:3532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24686.exe
        6⤵
        
        PID:12000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15297.exe
        6⤵
        
        PID:1588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46207.exe
        5⤵
        
        PID:6504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21367.exe
        6⤵
        
        PID:9088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3525.exe
        6⤵
        
        PID:12792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59900.exe
        6⤵
        
        PID:1540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61148.exe
        5⤵
        
        PID:9784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62099.exe
        5⤵
        
        PID:14072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8016.exe
        5⤵
        
        PID:16116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37481.exe
        5⤵
        
        PID:3984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45362.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45217.exe
        5⤵
        
        PID:4140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51159.exe
        6⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49929.exe
        7⤵
        
        PID:9400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
        7⤵
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12129.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47092.exe
        6⤵
        
        PID:3604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5803.exe
        5⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26489.exe
        6⤵
        
        PID:13596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        6⤵
        
        PID:1708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60147.exe
        6⤵
        
        PID:8744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35569.exe
        5⤵
        
        PID:12176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16215.exe
        5⤵
        
        PID:4032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38233.exe
      4⤵
      PID:1280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32939.exe
        5⤵
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-178.exe
        6⤵
        
        PID:7720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30267.exe
        7⤵
        
        PID:2692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47298.exe
        6⤵
        
        PID:13380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56910.exe
        6⤵
        
        PID:3148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20359.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62377.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34882.exe
        5⤵
        
        PID:14932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17525.exe
      4⤵
      PID:1292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15118.exe
        5⤵
        
        PID:9308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3086.exe
        5⤵
        
        PID:5468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20916.exe
      4⤵
      PID:9832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15421.exe
      4⤵
      PID:5944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17297.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17297.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61449.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35923.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6924.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11968.exe
        7⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24195.exe
        8⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51735.exe
        9⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65078.exe
        10⤵
        
        PID:16468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43081.exe
        10⤵
        
        PID:14568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58014.exe
        9⤵
        
        PID:11840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
        9⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33021.exe
        8⤵
        
        PID:8536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34351.exe
        9⤵
        
        PID:14980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55579.exe
        8⤵
        
        PID:13412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2357.exe
        8⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27079.exe
        7⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35399.exe
        8⤵
        
        PID:7948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28487.exe
        9⤵
        
        PID:10936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1288.exe
        9⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10951.exe
        8⤵
        
        PID:12084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40035.exe
        8⤵
        
        PID:13868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22636.exe
        7⤵
        
        PID:8272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38933.exe
        8⤵
        
        PID:18052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23920.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19422.exe
        7⤵
        
        PID:14560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51418.exe
        6⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
        7⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe
        8⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6374.exe
        9⤵
        
        PID:10196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40035.exe
        9⤵
        
        PID:13840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9197.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
        8⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24085.exe
        7⤵
        
        PID:7480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24595.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40035.exe
        8⤵
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24686.exe
        7⤵
        
        PID:11992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35224.exe
        7⤵
        
        PID:6268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63757.exe
        6⤵
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25093.exe
        7⤵
        
        PID:7824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64475.exe
        8⤵
        
        PID:11160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40872.exe
        8⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47710.exe
        8⤵
        
        PID:17176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29425.exe
        7⤵
        
        PID:11748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60003.exe
        7⤵
        
        PID:2812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8081.exe
        6⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57158.exe
        7⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17392.exe
        6⤵
        
        PID:12500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36407.exe
        6⤵
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13553.exe
        6⤵
        
        PID:732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56488.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5746.exe
        6⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46115.exe
        7⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23505.exe
        8⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54672.exe
        8⤵
        
        PID:14296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
        8⤵
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13612.exe
        7⤵
        
        PID:9800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27401.exe
        6⤵
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44771.exe
        7⤵
        
        PID:14808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55325.exe
        7⤵
        
        PID:16900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22932.exe
        6⤵
        
        PID:11440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64498.exe
        6⤵
        
        PID:5924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20612.exe
        5⤵
        
        PID:3492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44999.exe
        6⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55627.exe
        7⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6950.exe
        8⤵
        
        PID:9392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17476.exe
        8⤵
        
        PID:16336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9197.exe
        7⤵
        
        PID:11388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
        7⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
        7⤵
        
        PID:10628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58896.exe
        6⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39643.exe
        7⤵
        
        PID:16856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24686.exe
        6⤵
        
        PID:11976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63429.exe
        6⤵
        
        PID:16056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33281.exe
        6⤵
        
        PID:18308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13177.exe
        5⤵
        
        PID:6428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17283.exe
        6⤵
        
        PID:8072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48642.exe
        6⤵
        
        PID:12496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49464.exe
        6⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
        6⤵
        
        PID:6292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40231.exe
        5⤵
        
        PID:9700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45563.exe
        5⤵
        
        PID:14108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64295.exe
        5⤵
        
        PID:15192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47092.exe
        5⤵
        
        PID:5248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30255.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15092.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34527.exe
        6⤵
        
        PID:1124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4158.exe
        7⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16733.exe
        8⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15118.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18353.exe
        9⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9197.exe
        8⤵
        
        PID:11724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30798.exe
        8⤵
        
        PID:7268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50728.exe
        7⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22457.exe
        8⤵
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28783.exe
        9⤵
        
        PID:16952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38657.exe
        8⤵
        
        PID:14596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39113.exe
        8⤵
        
        PID:16408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60147.exe
        8⤵
        
        PID:18600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63965.exe
        7⤵
        
        PID:12380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27549.exe
        7⤵
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32471.exe
        6⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17283.exe
        7⤵
        
        PID:9160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3525.exe
        7⤵
        
        PID:14316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43031.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57525.exe
        6⤵
        
        PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22829.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28663.exe
        6⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51735.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6950.exe
        8⤵
        
        PID:9384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19422.exe
        8⤵
        
        PID:15236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48092.exe
        7⤵
        
        PID:11424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
        7⤵
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
        7⤵
        
        PID:18784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33021.exe
        6⤵
        
        PID:8520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40495.exe
        7⤵
        
        PID:15260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33941.exe
        7⤵
        
        PID:17448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9886.exe
        6⤵
        
        PID:12028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48502.exe
        6⤵
        
        PID:4312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2556.exe
        6⤵
        
        PID:1228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46207.exe
        5⤵
        
        PID:6496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43349.exe
        6⤵
        
        PID:9188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54672.exe
        6⤵
        
        PID:14196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3086.exe
        6⤵
        
        PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16223.exe
        5⤵
        
        PID:9456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20490.exe
        5⤵
        
        PID:13988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29313.exe
        5⤵
        
        PID:16388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41635.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40557.exe
        5⤵
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34309.exe
        6⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe
        7⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37833.exe
        8⤵
        
        PID:11076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1288.exe
        8⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9197.exe
        7⤵
        
        PID:11480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
        7⤵
        
        PID:13824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
        7⤵
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24085.exe
        6⤵
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55103.exe
        7⤵
        
        PID:9528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27558.exe
        7⤵
        
        PID:2424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24686.exe
        6⤵
        
        PID:11952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47668.exe
        6⤵
        
        PID:6636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3151.exe
        5⤵
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25093.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25581.exe
        7⤵
        
        PID:11144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27551.exe
        7⤵
        
        PID:13720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25235.exe
        7⤵
        
        PID:17404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40613.exe
        6⤵
        
        PID:11304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14653.exe
        6⤵
        
        PID:9000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46757.exe
        5⤵
        
        PID:8568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62046.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63429.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26478.exe
      4⤵
      PID:4328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8626.exe
        5⤵
        
        PID:2240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39483.exe
        6⤵
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46001.exe
        7⤵
        
        PID:10992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22969.exe
        7⤵
        
        PID:12496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43816.exe
        6⤵
        
        PID:11772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36828.exe
        6⤵
        
        PID:15532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11344.exe
        5⤵
        
        PID:8904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62294.exe
        5⤵
        
        PID:18020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47875.exe
      4⤵
      PID:6824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41979.exe
        5⤵
        
        PID:9064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11932.exe
        6⤵
        
        PID:12632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1186.exe
        6⤵
        
        PID:17120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48642.exe
        5⤵
        
        PID:14144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49047.exe
        5⤵
        
        PID:15764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23695.exe
      4⤵
      PID:9640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62629.exe
      4⤵
      PID:14100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35627.exe
      4⤵
      PID:5812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63487.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63487.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46037.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12762.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23043.exe
        6⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9808.exe
        7⤵
        
        PID:8672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7438.exe
        8⤵
        
        PID:14440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33941.exe
        8⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31320.exe
        7⤵
        
        PID:12932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58659.exe
        7⤵
        
        PID:15932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15533.exe
        6⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46743.exe
        7⤵
        
        PID:13144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42305.exe
        7⤵
        
        PID:13820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24686.exe
        6⤵
        
        PID:12032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63429.exe
        6⤵
        
        PID:15672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17567.exe
        5⤵
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32109.exe
        6⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35455.exe
        7⤵
        
        PID:10888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12941.exe
        7⤵
        
        PID:17424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5828.exe
        6⤵
        
        PID:10516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63429.exe
        6⤵
        
        PID:14436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57857.exe
        5⤵
        
        PID:3712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28487.exe
        6⤵
        
        PID:10944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        6⤵
        
        PID:13736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41434.exe
        5⤵
        
        PID:12136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41757.exe
        5⤵
        
        PID:1176
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1176 -s 464
        6⤵
        Program crash
        
        PID:18548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30421.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64075.exe
        5⤵
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52337.exe
        6⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27589.exe
        7⤵
        
        PID:8856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43017.exe
        8⤵
        
        PID:16320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48642.exe
        7⤵
        
        PID:14288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3086.exe
        7⤵
        
        PID:1780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39601.exe
        6⤵
        
        PID:9536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23290.exe
        6⤵
        
        PID:13924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19422.exe
        6⤵
        
        PID:888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62404.exe
        5⤵
        
        PID:6972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1076.exe
        6⤵
        
        PID:10900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40035.exe
        6⤵
        
        PID:15640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
        6⤵
        
        PID:19332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe
        5⤵
        
        PID:11756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65323.exe
        5⤵
        
        PID:17764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37481.exe
        5⤵
        
        PID:18736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59891.exe
      4⤵
      PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48061.exe
        5⤵
        
        PID:6656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41979.exe
        6⤵
        
        PID:9008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3525.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56910.exe
        6⤵
        
        PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23265.exe
        5⤵
        
        PID:9672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64899.exe
        5⤵
        
        PID:14308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19422.exe
        5⤵
        
        PID:16068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48948.exe
      4⤵
      PID:7252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49929.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18929.exe
        5⤵
        
        PID:3184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
        5⤵
        
        PID:19316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20132.exe
      4⤵
      PID:11456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45957.exe
      4⤵
      PID:3572
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 436
        5⤵
        Program crash
        
        PID:10152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17759.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17759.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10816.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18575.exe
        5⤵
        
        PID:924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4350.exe
        6⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57355.exe
        7⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4319.exe
        7⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56179.exe
        7⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38641.exe
        6⤵
        
        PID:7420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17260.exe
        6⤵
        
        PID:13676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18353.exe
        6⤵
        
        PID:16212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62020.exe
        5⤵
        
        PID:6216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1076.exe
        6⤵
        
        PID:10672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40382.exe
        7⤵
        
        PID:3900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36828.exe
        6⤵
        
        PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23186.exe
        5⤵
        
        PID:9532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8016.exe
        5⤵
        
        PID:5596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51802.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33131.exe
        5⤵
        
        PID:5184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51735.exe
        6⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40521.exe
        7⤵
        
        PID:13320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49047.exe
        7⤵
        
        PID:3356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58014.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19422.exe
        6⤵
        
        PID:9724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47796.exe
        5⤵
        
        PID:8308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20576.exe
        5⤵
        
        PID:13644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39689.exe
        5⤵
        
        PID:5380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15864.exe
      4⤵
      PID:6868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23505.exe
        5⤵
        
        PID:8844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54672.exe
        5⤵
        
        PID:14240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51109.exe
        5⤵
        
        PID:17000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59202.exe
      4⤵
      PID:9520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20490.exe
      4⤵
      PID:13944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63429.exe
      4⤵
      PID:16048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12000.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12000.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40941.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52337.exe
        5⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37895.exe
        6⤵
        
        PID:9204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54672.exe
        6⤵
        
        PID:14188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        6⤵
        
        PID:2704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19181.exe
        5⤵
        
        PID:9588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61133.exe
        6⤵
        
        PID:11572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14315.exe
        6⤵
        
        PID:468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45849.exe
        5⤵
        
        PID:14268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1288.exe
        5⤵
        
        PID:5676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62404.exe
      4⤵
      PID:6792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64475.exe
        5⤵
        
        PID:10056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23416.exe
        6⤵
        
        PID:2824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51602.exe
        5⤵
        
        PID:6220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe
      4⤵
      PID:11592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62936.exe
      4⤵
      PID:6052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44831.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44831.exe
    3⤵
    PID:5284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9808.exe
      4⤵
      PID:8664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13878.exe
        5⤵
        
        PID:11416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35237.exe
        5⤵
        
        PID:15944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38.exe
        5⤵
        
        PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41626.exe
      4⤵
      PID:12604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42525.exe
      4⤵
      PID:17048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26999.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26999.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20511.exe
      4⤵
      PID:10116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42687.exe
      4⤵
      PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
      4⤵
      PID:18848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-886.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-886.exe
    3⤵
    PID:11944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26605.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26605.exe
    3⤵
    PID:15384
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20421.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20421.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8574.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8574.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2113.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2113.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32031.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28907.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42311.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49493.exe
        7⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17719.exe
        8⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6374.exe
        9⤵
        
        PID:10212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
        9⤵
        
        PID:13800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
        9⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55108.exe
        8⤵
        
        PID:9748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19381.exe
        8⤵
        
        PID:15324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33281.exe
        8⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56374.exe
        7⤵
        
        PID:8008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60002.exe
        8⤵
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19232.exe
        7⤵
        
        PID:12220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-938.exe
        7⤵
        
        PID:5204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36425.exe
        6⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32109.exe
        7⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13328.exe
        8⤵
        
        PID:10524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18353.exe
        8⤵
        
        PID:1392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46400.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63429.exe
        7⤵
        
        PID:15004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16824.exe
        6⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40521.exe
        7⤵
        
        PID:11576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22969.exe
        7⤵
        
        PID:2124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30552.exe
        6⤵
        
        PID:11960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56147.exe
        6⤵
        
        PID:2988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24391.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37817.exe
        6⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe
        7⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33017.exe
        8⤵
        
        PID:10228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19422.exe
        8⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16981.exe
        7⤵
        
        PID:10988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45722.exe
        7⤵
        
        PID:17132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24085.exe
        6⤵
        
        PID:7592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24686.exe
        6⤵
        
        PID:12092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34648.exe
        6⤵
        
        PID:16396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11074.exe
        5⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15118.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19422.exe
        7⤵
        
        PID:14736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
        7⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9197.exe
        6⤵
        
        PID:11520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40912.exe
        6⤵
        
        PID:856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48675.exe
        6⤵
        
        PID:16704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55938.exe
        5⤵
        
        PID:7656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46743.exe
        6⤵
        
        PID:13128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39098.exe
        6⤵
        
        PID:16444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32768.exe
        5⤵
        
        PID:12168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63363.exe
        5⤵
        
        PID:804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19347.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21699.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56291.exe
        6⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11304.exe
        7⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41979.exe
        8⤵
        
        PID:9180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25164.exe
        9⤵
        
        PID:14876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3525.exe
        8⤵
        
        PID:13180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11221.exe
        8⤵
        
        PID:15220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31894.exe
        7⤵
        
        PID:10244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3986.exe
        7⤵
        
        PID:17756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9745.exe
        7⤵
        
        PID:18396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62404.exe
        6⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15118.exe
        7⤵
        
        PID:9280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23054.exe
        8⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19422.exe
        7⤵
        
        PID:15276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe
        6⤵
        
        PID:11568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39765.exe
        6⤵
        
        PID:15624
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15624 -s 84
        7⤵
        Program crash
        
        PID:16000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25048.exe
        6⤵
        
        PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17951.exe
        5⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56374.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34351.exe
        7⤵
        
        PID:13436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43081.exe
        7⤵
        
        PID:3316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24686.exe
        6⤵
        
        PID:11908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13351.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39383.exe
        5⤵
        
        PID:7960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55649.exe
        6⤵
        
        PID:6140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30552.exe
        5⤵
        
        PID:12020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32867.exe
        6⤵
        
        PID:16656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59162.exe
        5⤵
        
        PID:6228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38127.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31595.exe
        5⤵
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3520.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17283.exe
        7⤵
        
        PID:9104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62140.exe
        8⤵
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54672.exe
        7⤵
        
        PID:14156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59726.exe
        7⤵
        
        PID:6016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31894.exe
        6⤵
        
        PID:10252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32839.exe
        6⤵
        
        PID:10460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13351.exe
        6⤵
        
        PID:16104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34504.exe
        5⤵
        
        PID:8640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55077.exe
        6⤵
        
        PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31512.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26189.exe
        5⤵
        
        PID:16984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19461.exe
      4⤵
      PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe
        5⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6374.exe
        6⤵
        
        PID:10180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57938.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12666.exe
        6⤵
        
        PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-645.exe
        5⤵
        
        PID:11212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45722.exe
        5⤵
        
        PID:17256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4294.exe
      4⤵
      PID:7356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41565.exe
        5⤵
        
        PID:15908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16254.exe
        5⤵
        
        PID:16416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34259.exe
      4⤵
      PID:12072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62845.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:17160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38153.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38153.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8486.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22275.exe
        5⤵
        
        PID:3460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44423.exe
        6⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27231.exe
        7⤵
        
        PID:7872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65217.exe
        8⤵
        
        PID:11412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43017.exe
        8⤵
        
        PID:1120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7748.exe
        7⤵
        
        PID:12152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2357.exe
        7⤵
        
        PID:3276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8901.exe
        6⤵
        
        PID:8276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10946.exe
        7⤵
        
        PID:13704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29513.exe
        7⤵
        
        PID:740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18054.exe
        6⤵
        
        PID:11452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52586.exe
        6⤵
        
        PID:14724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16946.exe
        6⤵
        
        PID:7188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37385.exe
        5⤵
        
        PID:5552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35399.exe
        6⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21149.exe
        7⤵
        
        PID:9448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19422.exe
        7⤵
        
        PID:15136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48092.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
        6⤵
        
        PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46757.exe
        5⤵
        
        PID:8560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24927.exe
        6⤵
        
        PID:15604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56671.exe
        5⤵
        
        PID:13660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33513.exe
        5⤵
        
        PID:2036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59778.exe
      4⤵
      PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7282.exe
        5⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe
        6⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49929.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26326.exe
        7⤵
        
        PID:14792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51558.exe
        7⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9197.exe
        6⤵
        
        PID:11512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
        6⤵
        
        PID:1916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24085.exe
        5⤵
        
        PID:7504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13878.exe
        6⤵
        
        PID:12108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29876.exe
        6⤵
        
        PID:8808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25454.exe
        5⤵
        
        PID:12780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19422.exe
        5⤵
        
        PID:11408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63757.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63757.exe
      4⤵
      PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28767.exe
        5⤵
        
        PID:8300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        6⤵
        
        PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4319.exe
        5⤵
        
        PID:11628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40912.exe
        5⤵
        
        PID:760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-243.exe
        5⤵
        
        PID:18896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58242.exe
      4⤵
      PID:8156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14460.exe
      4⤵
      PID:14332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45957.exe
      4⤵
      PID:4644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47116.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47116.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28497.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17205.exe
        5⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45321.exe
        6⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6374.exe
        7⤵
        
        PID:10204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19422.exe
        7⤵
        
        PID:15668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
        7⤵
        
        PID:18700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9197.exe
        6⤵
        
        PID:11472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49656.exe
        6⤵
        
        PID:3084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
        6⤵
        
        PID:8840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24085.exe
        5⤵
        
        PID:7496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17131.exe
        6⤵
        
        PID:6248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24686.exe
        5⤵
        
        PID:12536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34882.exe
        5⤵
        
        PID:16332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46924.exe
      4⤵
      PID:1212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16733.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37833.exe
        6⤵
        
        PID:11068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40872.exe
        6⤵
        
        PID:14184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1908.exe
        6⤵
        
        PID:16812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
        6⤵
        
        PID:18648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9197.exe
        5⤵
        
        PID:11488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
        5⤵
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
        5⤵
        
        PID:18772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37821.exe
      4⤵
      PID:7384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46743.exe
        5⤵
        
        PID:12768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3324.exe
        5⤵
        
        PID:16968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43081.exe
        5⤵
        
        PID:8392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63992.exe
      4⤵
      PID:1948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47092.exe
      4⤵
      PID:2688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60599.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60599.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25709.exe
      4⤵
      PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51735.exe
        5⤵
        
        PID:7804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58014.exe
        5⤵
        
        PID:12428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48542.exe
        5⤵
        
        PID:15396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46757.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46757.exe
      4⤵
      PID:8528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49457.exe
        5⤵
        
        PID:14092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58449.exe
        5⤵
        
        PID:1912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19067.exe
      4⤵
      PID:13028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63429.exe
      4⤵
      PID:4760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62128.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62128.exe
    3⤵
    PID:5644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe
      4⤵
      PID:7124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49929.exe
        5⤵
        
        PID:9492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29181.exe
        5⤵
        
        PID:14612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
        5⤵
        
        PID:13752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9197.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51109.exe
      4⤵
      PID:17208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20776.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20776.exe
    3⤵
    PID:8172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49047.exe
      4⤵
      PID:1852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11768.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11768.exe
    3⤵
    PID:12200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4219.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4219.exe
    3⤵
    PID:16080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19506.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19506.exe
    3⤵
    PID:5880
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2444.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2444.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4080.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4080.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41953.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10816.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18575.exe
        6⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15580.exe
        7⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41979.exe
        8⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3525.exe
        8⤵
        
        PID:11300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47900.exe
        8⤵
        
        PID:15640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48934.exe
        8⤵
        
        PID:1404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29295.exe
        7⤵
        
        PID:9712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64899.exe
        7⤵
        
        PID:14356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63429.exe
        7⤵
        
        PID:15232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62404.exe
        6⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64044.exe
        7⤵
        
        PID:10912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30263.exe
        7⤵
        
        PID:17196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30716.exe
        6⤵
        
        PID:11124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27138.exe
        7⤵
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3986.exe
        6⤵
        
        PID:17748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21075.exe
        5⤵
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15580.exe
        6⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41979.exe
        7⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40382.exe
        8⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43081.exe
        8⤵
        
        PID:8820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3525.exe
        7⤵
        
        PID:13340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
        7⤵
        
        PID:13780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31894.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11806.exe
        6⤵
        
        PID:6696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17619.exe
        5⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23665.exe
        6⤵
        
        PID:13172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43017.exe
        6⤵
        
        PID:13508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59617.exe
        6⤵
        
        PID:19296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32768.exe
        5⤵
        
        PID:12144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42634.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1065.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22467.exe
        5⤵
        
        PID:900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38693.exe
        6⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17283.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3525.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39505.exe
        7⤵
        
        PID:13836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43081.exe
        7⤵
        
        PID:18812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43031.exe
        6⤵
        
        PID:9648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45957.exe
        6⤵
        
        PID:15688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9745.exe
        6⤵
        
        PID:19324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32471.exe
        5⤵
        
        PID:6456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15913.exe
        6⤵
        
        PID:9408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55248.exe
        6⤵
        
        PID:14516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39505.exe
        6⤵
        
        PID:14048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21240.exe
        5⤵
        
        PID:8908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63247.exe
        5⤵
        
        PID:17484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49777.exe
      4⤵
      PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34247.exe
        5⤵
        
        PID:7156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27719.exe
        6⤵
        
        PID:10800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19402.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33955.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42917.exe
        5⤵
        
        PID:14448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9267.exe
        5⤵
        
        PID:12184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45248.exe
      4⤵
      PID:7992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14070.exe
        5⤵
        
        PID:9960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56910.exe
        5⤵
        
        PID:13500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16432.exe
      4⤵
      PID:12268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12216.exe
      4⤵
      PID:8756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28885.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28885.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20931.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30635.exe
        5⤵
        
        PID:4356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8434.exe
        6⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18461.exe
        7⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35045.exe
        7⤵
        
        PID:12284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34351.exe
        7⤵
        
        PID:8868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65284.exe
        6⤵
        
        PID:8636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17260.exe
        6⤵
        
        PID:13656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34351.exe
        6⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62020.exe
        5⤵
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49929.exe
        6⤵
        
        PID:10384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40912.exe
        6⤵
        
        PID:1464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe
        5⤵
        
        PID:9760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34351.exe
        6⤵
        
        PID:8260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43081.exe
        6⤵
        
        PID:18732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2424.exe
        5⤵
        
        PID:8416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36041.exe
      4⤵
      PID:5212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5274.exe
        5⤵
        
        PID:6564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21367.exe
        6⤵
        
        PID:9080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3525.exe
        6⤵
        
        PID:13104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54095.exe
        6⤵
        
        PID:15700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48170.exe
        6⤵
        
        PID:13856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2653.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64899.exe
        5⤵
        
        PID:14912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7606.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17619.exe
      4⤵
      PID:7892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31014.exe
      4⤵
      PID:12488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61609.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37359.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37359.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16437.exe
      4⤵
      PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54475.exe
        5⤵
        
        PID:6400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37833.exe
        6⤵
        
        PID:11036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17816.exe
        6⤵
        
        PID:15392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47962.exe
        5⤵
        
        PID:10064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44077.exe
        5⤵
        
        PID:1684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35761.exe
      4⤵
      PID:7144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41185.exe
        5⤵
        
        PID:10088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
        5⤵
        
        PID:4820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30716.exe
      4⤵
      PID:11192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42104.exe
        5⤵
        
        PID:16876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59930.exe
      4⤵
      PID:17088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40676.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40676.exe
    3⤵
    PID:5152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29731.exe
      4⤵
      PID:8044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46743.exe
        5⤵
        
        PID:11608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24813.exe
        5⤵
        
        PID:17064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19232.exe
      4⤵
      PID:12232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62360.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33281.exe
      4⤵
      PID:18836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26468.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26468.exe
    3⤵
    PID:7920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5351.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5351.exe
    3⤵
    PID:12044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33489.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33489.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4352
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3815.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3815.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7142.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7142.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-510.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47739.exe
        5⤵
        
        PID:5340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52337.exe
        6⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11252.exe
        7⤵
        
        PID:8120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3373.exe
        8⤵
        
        PID:9248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54672.exe
        7⤵
        
        PID:14280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3086.exe
        7⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38616.exe
        7⤵
        
        PID:8208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58076.exe
        6⤵
        
        PID:9612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64899.exe
        6⤵
        
        PID:14364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18892.exe
        6⤵
        
        PID:9752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62404.exe
        5⤵
        
        PID:6916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6374.exe
        6⤵
        
        PID:10188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3086.exe
        6⤵
        
        PID:4348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58729.exe
        5⤵
        
        PID:10920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36407.exe
        5⤵
        
        PID:700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40387.exe
        5⤵
        
        PID:17028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48294.exe
      4⤵
      PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11304.exe
        5⤵
        
        PID:6584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15118.exe
        6⤵
        
        PID:9368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40912.exe
        6⤵
        
        PID:15564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5012.exe
        6⤵
        
        PID:5544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7505.exe
        5⤵
        
        PID:7652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12611.exe
        5⤵
        
        PID:14596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34197.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10602.exe
      4⤵
      PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49929.exe
        5⤵
        
        PID:9516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18353.exe
        5⤵
        
        PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28798.exe
      4⤵
      PID:11396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47540.exe
      4⤵
      PID:856
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 464
        5⤵
        Program crash
        
        PID:9336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54350.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54350.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31211.exe
      4⤵
      PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52098.exe
        5⤵
        
        PID:3688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37833.exe
        6⤵
        
        PID:11084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34472.exe
        6⤵
        
        PID:17456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22932.exe
        5⤵
        
        PID:11712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63429.exe
        5⤵
        
        PID:3104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33281.exe
        5⤵
        
        PID:8800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62404.exe
      4⤵
      PID:6780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49929.exe
        5⤵
        
        PID:9420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60003.exe
        5⤵
        
        PID:8764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33281.exe
        5⤵
        
        PID:3656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe
      4⤵
      PID:11432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12858.exe
      4⤵
      PID:17144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62029.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62029.exe
    3⤵
    PID:5436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17719.exe
      4⤵
      PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15118.exe
        5⤵
        
        PID:9692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47011.exe
        5⤵
        
        PID:14260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57440.exe
        5⤵
        
        PID:2396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42123.exe
      4⤵
      PID:9844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63429.exe
      4⤵
      PID:15600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10437.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10437.exe
    3⤵
    PID:8000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30267.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52613.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52613.exe
    3⤵
    PID:12060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12216.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12216.exe
    3⤵
    PID:13660
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39821.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39821.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63909.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63909.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64075.exe
      4⤵
      PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42861.exe
        5⤵
        
        PID:6008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe
        6⤵
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37833.exe
        7⤵
        
        PID:11052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47518.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44994.exe
        6⤵
        
        PID:10796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29578.exe
        6⤵
        
        PID:16908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24085.exe
        5⤵
        
        PID:7376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20895.exe
        6⤵
        
        PID:11632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63739.exe
        6⤵
        
        PID:15488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        6⤵
        
        PID:13744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24686.exe
        5⤵
        
        PID:12100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9267.exe
        5⤵
        
        PID:1964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61060.exe
      4⤵
      PID:6596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58315.exe
        5⤵
        
        PID:8896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48642.exe
        5⤵
        
        PID:14128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49047.exe
        5⤵
        
        PID:15372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59559.exe
      4⤵
      PID:9548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5227.exe
      4⤵
      PID:6924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34882.exe
      4⤵
      PID:16128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33903.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33903.exe
    3⤵
    PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32939.exe
      4⤵
      PID:6164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31803.exe
        5⤵
        
        PID:11000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49848.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47578.exe
      4⤵
      PID:9848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5200.exe
      4⤵
      PID:14696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1288.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10218.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10218.exe
    3⤵
    PID:5492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49929.exe
      4⤵
      PID:9468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14269.exe
      4⤵
      PID:15792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21348.exe
      4⤵
      PID:6684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9171.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9171.exe
    3⤵
    PID:9740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42942.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42942.exe
    3⤵
    PID:5028
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48749.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48749.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39571.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39571.exe
    3⤵
    PID:5304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38331.exe
      4⤵
      PID:7136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48009.exe
        5⤵
        
        PID:8144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3525.exe
        5⤵
        
        PID:11904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
        5⤵
        
        PID:4376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31894.exe
      4⤵
      PID:10260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63429.exe
      4⤵
      PID:15680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56374.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56374.exe
    3⤵
    PID:8016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24686.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24686.exe
    3⤵
    PID:11936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34648.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34648.exe
    3⤵
    PID:14788
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22810.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22810.exe
  2⤵
  PID:5396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8180.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8180.exe
    3⤵
    PID:6356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54013.exe
      4⤵
      PID:9340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29181.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29181.exe
      4⤵
      PID:14836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40912.exe
      4⤵
      PID:4628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48675.exe
      4⤵
      PID:760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33281.exe
      4⤵
      PID:16072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42123.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42123.exe
    3⤵
    PID:9632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63429.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63429.exe
    3⤵
    PID:15892
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14020.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14020.exe
  2⤵
  PID:7472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46412.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46412.exe
    3⤵
    PID:5464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43081.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43081.exe
    3⤵
    PID:19312
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55633.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55633.exe
  2⤵
  PID:10688
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15840.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15840.exe
  2⤵
  PID:14916
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3046.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3046.exe
  2⤵
  PID:8400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 14596 -ip 14596
1⤵
PID:15736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 13180 -ip 13180
1⤵
PID:14732

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:15600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 7920 -ip 7920
1⤵
PID:15212

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:8576

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:7716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 468 -ip 468
1⤵
PID:10148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1112.exe

Filesize
468KB

MD5
225ff69e8f9055569d754066073677f4

SHA1
601d558136c9c02d9db6a428fe68d636db1d29a4

SHA256
5a3aee8d92607d98cdc18cfe83b786aa8b60b5af3e8a75a4c41742b549a2685c

SHA512
4e7839df038143df97a910fd31ee10b203170cf5cf46c08946018322377754dc279d14a5fe737c9ff22c8339fb9711361aec098c27ee94a2c397801b8d7cc2e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13612.exe

Filesize
468KB

MD5
1dcb3f28d63d4595e894a5c2033a9d68

SHA1
4a969881bdc88cc8c25559f4de2402681fe0b4ca

SHA256
684f7efab7f276ca15d98e45113d9320e194eb99f9d801af1e9797e4f1dbf1bc

SHA512
f04fca652526fbf5a2f9a67987ae2352b572fb3fe6f4874f7048a97496371c5bd141e7a79ddec9baff88e2d0f97221698e6a813b02b758cfb524b34cdd602470

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17209.exe

Filesize
468KB

MD5
a848f651c1f39048d42d7be23728ca4d

SHA1
9958b94c18aa83b4a0b13e63a22d453a1888e931

SHA256
ba3b81b80b5df63f57bac3cb2a64acee26d4d66ba2ca107702b071e8f73d1a43

SHA512
e89f2dafc85a195537cfcbfe29abe6e4ed0288fab4ce7b3bbf53aca1b4fdaa8f2e6589ed98676542366de78d76454fcaec497d6f88ccde5edd7c0cbdad34493e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17297.exe

Filesize
468KB

MD5
cd4632ac11ffb6ad7d9a8e8d764dd237

SHA1
3e85cc4ae2877d8c8f04bbad42ed461341d9b5aa

SHA256
791789afae089bdae5eb6523f294c8c6a589dad3eb17950f5003fab46a11f079

SHA512
de4c23bf1730bb6a7ef5fa19208d741f7182d17540818a042380e26830302791710feb28fcf2e2f009086d7e12a733ee44d302196a1cb1833870b450c88719bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17759.exe

Filesize
468KB

MD5
a8e775e625034c53bf0c2e271f46feff

SHA1
016a05c66830ac26e02b71b85ffa728741f13cad

SHA256
953d7e4320be6c70590e0c3588f8de2f5628d26ebfbfcafd185f2a7e2c7cd925

SHA512
7ccbe67262c8a342689569a6eb5e0b9914732b16deb3852226ce0edcaa2800c8fe1042a6a082b33245122b280b7251cc179bbdf36dc23f1487a5cdc148a23d03

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18715.exe

Filesize
468KB

MD5
bd6513a98796fc55aeeb21cae1081371

SHA1
bde5ae85b6da1bd8781e73b029b097047afc7701

SHA256
65a90d8d03a653395faf68099217e1daf0353cbd51152c16a23f237df6cf8381

SHA512
590e7bbc72d89dba93e5f55953884b52c26e7e4113842f5ea309177d9a2981d0b20475278a3778779bc79b9752208a0b6e18938e7697a1eacdaeff9955cac70c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19347.exe

Filesize
468KB

MD5
25ca1a86894bdad27ce706078596f8b2

SHA1
5ba20ce24516fa678a041506d61ce9ec77d87ee6

SHA256
f3d819fc4dc5c45b102a66ee729948dcb06af0f575e5ce054cb31c52f6f3dc51

SHA512
38d8a93ba6b011080d07ba11f9883699270dfec2110a53a87c3b25cef5d19b6ed74c7e304a032124f1680fb29b281e0156d11d21d26fa58b398fc1f6e3b17b4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20421.exe

Filesize
468KB

MD5
0b25c1735206607b23f1e7f19728d883

SHA1
b676a5fe31bf5d390d23329355675ae104a2a26d

SHA256
3c70196c754d870d643abf084f8c8e491dcc3e6351f082e1e1bf9fbbfea4ea88

SHA512
733da82cb6c4a8d1c0799757c2e9f944241e6bf53bb75750390a6ef794b0642e9c187ff2461de5636aa00a872fc7a9332aec5f39221fbf8d3f76f3656d85c36b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2113.exe

Filesize
468KB

MD5
c5ae3b1578c4b366d1630e5f0690f68c

SHA1
8612dee4aefcf9421357ada81cfeb1d97f5b35ae

SHA256
e69d32ca0074d9487f1b7c6e498146c85f9f56f7f300577516bba8a568fde75a

SHA512
aa5ea1c33750aa2746bef1ca411e25473103cd862df2109e6f4f2699494bc75d9cbda14cd40eec7c71cf55d08aad19ee7561ca0a76e6ec6710c24f25ea32098c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2444.exe

Filesize
468KB

MD5
cca1eeda92a3d0c0fbc46c2401321b7b

SHA1
233fb577d0aef068aeb117eca721ae22908c8dc4

SHA256
8cbb2d762d956f8f5c211702c252b556f115b2d0f5eef4ea703aa8acc8386958

SHA512
5f72c121fb6ab3c028e0402c6fbc2eab197b1d19e9b1ea2bcf8a46fcc3ec788e9f855b676ee3e37fd9588ce4e49afd147a3073ded2cb97580911743ec896be97

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28885.exe

Filesize
468KB

MD5
c2f648641686214a1d87b39142f56fd7

SHA1
b63b67c5b1cd27ac567e15692b9402231424e690

SHA256
73ce72660ef5bfd5145670197b3c7e1d83600cbfd6edcd817e0c8276dfe46282

SHA512
008047118984761f9ad62ca802a41a303c3957fd5c8d2e01feba782f1b53a6883564b4ab789414b6af136b9624155bcf6491e19eea9b7a19a3bac950f0152859

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28907.exe

Filesize
468KB

MD5
dbc90cde2a5a48bf815c8b73542e811d

SHA1
43d108819e4074b6c2139d50fa71b2fbd8921984

SHA256
40b15437ad3baca0b2825619d55a2adebb5a27bc29f846133e6eb94d501d6d98

SHA512
aeb443b068df44a5032eec176e9274eb525323556ebb0b31b3f59ba7be7239d97d5b9c8f4b8c2c587c580491a5a42480d2710374da7e94e496102a6a3076aefc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30255.exe

Filesize
468KB

MD5
f7023340910945c7192d64e16839a9a8

SHA1
12e4ef434b1e78309978a40ebf65899fd5a20661

SHA256
0ba864a8f06658d86d587aa12ef252f46482587865b9ca5db9fef1d539018d8d

SHA512
9f058e157ca63f04c063a05505ffbe0bd35e393d3fb256af70dd9e2e512fbeaab469a4648fef3df182c6fdf0c68741dbfdb4839578f41683294b18dccfed1617

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32031.exe

Filesize
468KB

MD5
2f1ef884c9611143266a4f33aa8c80dc

SHA1
428e0dc0bb3316b852695c4157fe39fd40ca94c7

SHA256
e0d348f45eb906aefe0605d646275a41e14773fb3306f020c56c14a279d8ca4a

SHA512
a9cdcc821b31aae8b7ca76e28917598725eb286a922072da492b0bdd30f87bdd0e6b1c5ee4e306ff7afb31be8cad23187795ed7e4140395c3ef029f477164ac2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33079.exe

Filesize
468KB

MD5
df2054ff513bd718f46dcfa2b2877367

SHA1
cfd8d6dd9cdfdde8bbc60b30a866fd68e5cbaa92

SHA256
00ebca5807099c1b121509d5c2a2bdf8a5c4b69e5c31ac5a960906c20ade3ecf

SHA512
9c979672706e65e8d99c4827f312039b1174504ac01caa2ea4fa8c6bfa129f416a7534a4f090539a295bb0feb22e9e3e91206864798d17c84fe361be7de7d05b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3338.exe

Filesize
468KB

MD5
6f860c41bc01da5448aba1107ec31b8d

SHA1
f93939411522899fe1ff8ee1abf2b13a43ff09ce

SHA256
20e5548f51fa2911f1588ea93598b2e495c7a897267aed06683d4bd7e9a99bdf

SHA512
11b810f39d42b1f266d1621b6ee6f8087862d7cc7e826f18808a92d30f5a0d8627a8eddd034545eb35fab51bfb23fa5f649c4dc0015f396337120e17cd5f01f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35923.exe

Filesize
468KB

MD5
2e0b126c0471bb51b216bf14eb07577a

SHA1
fbd50b64d64d3113fd84639152e02a97d2a70c46

SHA256
da2965a63a678d68b0c0e17d785e7dbc892fe1c13295ecd8d834a53be124c0c9

SHA512
2af22b502ccc9684c4e83cf8a26651411086a0fcc112fb0b0463442899133fda2ad1b8feb4b652ded94fabd4fd57b03952d6074b39c6f5174a2640ed744e4496

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3815.exe

Filesize
468KB

MD5
06694d821406b4cc33c7b5c00c8ebf6c

SHA1
620b5d4ae7c51c35b5e0504b82d45aec9f854bb1

SHA256
f96a43d8ae24389caa4e29a6471ae4af71704181aba3498f785ea84078943e06

SHA512
e0350115ec9fd45d628a25a04dd24e47df00156b5caae7f45c2c9e341a178c98fa68f0df490aeb1f96b6c5c7b4c2287020d5d6ee58dfc282b75e69dc1af8500f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38153.exe

Filesize
468KB

MD5
0d27a5b1fba93466c8625b768a2e7650

SHA1
aafe7c72e22ae14dbf5c8df00effbefe7533d214

SHA256
16ba8abf02bd32257d30eafc8fdca050da5e47a676b39be9aec294096e36aac5

SHA512
c75edb2bc2458dac985888ad5c9b86b0f9e7784809f71762e2edee93a3e9292a751bd7d69152117639c3721f7aec00178c108b678bcc200a78099664afb6cc1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39821.exe

Filesize
468KB

MD5
431eb40c27dade21c90b26bcc97aa414

SHA1
ab1515a721defa3cf33e7099d3c031d011e65eee

SHA256
2a132e8d9831b27a95425fd0676e2aa66054539bf1e1530fa30d332f221ea552

SHA512
b508cacc2b53a4c28fe70df60fc310b44656bcdb16d79fc69ec159939e5f8b4a8c51134c41b2da9a5955425e3e79185848cb5315468d8bc796b32371e2ab1bbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4080.exe

Filesize
468KB

MD5
08228786dfda9e3a6969812caabe3cd5

SHA1
58cfd080d41a3b98c4c70b0a580bae36ff6e38b2

SHA256
67bf36fe126f4006785cec77f05572eb3ce55f245dc1ef5aa291c1e7d7eaeb8a

SHA512
8eb3e76e360ebfc3ebee71a308e5a45a5df6816ac0353a0b203335b8b990269734f3f20c7f007ed5894810edcf228f439a8ca05df6b0f5beda434269183b0ce1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41029.exe

Filesize
468KB

MD5
4d5ee5699f09c54a69ecc49bcb43b361

SHA1
89d493e6e0d97623f15771abd68dd4bb0a414de9

SHA256
751e32f82449bae0a5b381795429b82947112cfaf6017f1232e2e2559204e170

SHA512
1996218070cd137c440a153c38cbba35c61b8e05c7277397a0ba8f1d3c8f5a8592641c5b36128760c56b896aadd9fae6f1870e2244a01713cde3f7319e8658ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41173.exe

Filesize
468KB

MD5
2093b3ed22a0f2b00ecf6f9b3e968e70

SHA1
b41be109294b531342fa669d67f04d13b67357f3

SHA256
389cf48b1497de11457a5cff90ca89623eef4e9d59b0d2d7ddde6ddb3b0d62c0

SHA512
121fa1a4ee1c89acff8231009f82367eaa749e5e81959363be2ea39b2a5fb3c6b4f57b483baf0c2c93142220862487b93c0ec1cd14a177f6e1bfb0e7073c2a75

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41953.exe

Filesize
468KB

MD5
f65dc5f29ab05c65ca8c9c29a23aa061

SHA1
48f40fb192e5313963afb76d2fdae15908b4b892

SHA256
c0900610f4358c03bf8c4866c23718ee5abfe71b708df1c8f4ddbcb11c598ace

SHA512
640cfc6fcc479ded62bf5dd5bbde294b2e46c930250e9bd29fb99f9d259701930acbce2c85afebb7ec379b77d384c300308fcf8a416147ccbc34cef298520b34

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42145.exe

Filesize
468KB

MD5
e4558098f603402bf1d481c1af8ccae2

SHA1
d50821999f58d13d3fefaf6dda4275f1f74f2446

SHA256
1855d9e09ced691a33a53c2e0bb35fc71787a35646b65d97c3d043c9f925fd3c

SHA512
82fb1fcc1ce86ac94b0475ec18e63a0c8289b634449c76bc9fa12908f7c287b0162987b1d9b63bb2168322b4382bffcadd797c44a229fbe3a292677f8f03afd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46037.exe

Filesize
468KB

MD5
56ba096ffa9497b079db57ec3fbc0da5

SHA1
85a6c2ad240c5b8efbe4a34276c33709f9422e3f

SHA256
17d02c18c0e44fcd82dce691f217f89642d73aa67a6cdd054108279d52f6b2dc

SHA512
99072e044817fd29cf786a2f5bdfb58ac0c2a576e02ac4bf7bc21e1d55d17d89ec5e91065526d82314f120242f21ef949392c3092dc53d027c57b52e0a040809

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47116.exe

Filesize
468KB

MD5
9d03c73170dba63cb2c6c1ada8414310

SHA1
7de4bd84ff4be8aa76958ab758bad22c2ba43a1a

SHA256
66810ef461c8b9a18baad95c38230a31e2be11657c3d508761a9439a17c6ea4d

SHA512
ab61bdcc7faa58e60e86178128d5538bb570fe0b197d59345f73e5ca5c8589858a47356358e00c5b11359222af926e3f2b10fc55f047f79fbf30afdd72e220f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51890.exe

Filesize
468KB

MD5
bf432b37c9bace9de4560366161d07ec

SHA1
a2a134ca12e2aa1570dbd06af7513483fdcae161

SHA256
19e6e798407951952bf80bfd0f8c472bd4b3408954efefe2bc840069960872bd

SHA512
0781cd8584b777212acc14281917b941f3038303c16e0e977ba2a39d90e8f4092369f82576c9575f7778dfadf28bbe5fdeb6fcd98018d74482eb31f48228d6a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52508.exe

Filesize
468KB

MD5
652e9f621e3da5da9f8569d9a6488bd7

SHA1
653c320984ea2e81a897520f6250c1c5f7bc6341

SHA256
128c0b5e1176f830867213f5114d785fa315996f436b9c1fe8ee96a065296e54

SHA512
0b937f219abd9e7c575397c4e727b6761dc3e58e0171deac2a890e2060aff7f7c22398568086750725894e00969ba14c9035bf09695d56db7fd9764f55bfa1db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60519.exe

Filesize
468KB

MD5
5bf92717939ae36a1a98e235a20673dd

SHA1
79f15e82b9109780290a06887a02f5cbe58d5cdd

SHA256
9363f40e1d1e3403c99e7a06ec09393a0d53334943578025a16b57b5a6c19686

SHA512
3dee80e5776ed5acfdc66c5278dd37de608a040285f6ce6444479727dd6ff76d19b4ffe22f025fe8a32ebc3e067c3a6bfe9e1f751ccdedb8e323f49a78dd0be6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61449.exe

Filesize
468KB

MD5
87b20d1258fcdedb967a9da975d5c0b5

SHA1
31ddf23d18a5b4b9002e496d5c16fd0cb3eb0d18

SHA256
87dd0416cd00f3cf91b21c4df856dc9cb71fc508341e02dd73ea1eb596c5e8fc

SHA512
a9d7b1df48df0e777b627df3d5f5155683126e053bb9ec563540bcf6d34d0a6e3b9b72bd31ea74bfaa80bec0bd88dcc8278039f72ef2e153730fd91e7c5298c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63487.exe

Filesize
468KB

MD5
8c4b9dc56d04f2a604ae6826314bdf62

SHA1
a9b8adbc76ed8f9430e5781075f774298a19d723

SHA256
78c20bb76f9777b5270239a82538ad9a2b8d5a497f807bb5d35c549d6ec0afcf

SHA512
92b0de24ce49a24b92374940df5b0f4c1b97be9803849401d13d155bd5f652aa8f654d9c48a7e032aef3b4c1f5acc8b67d6d7ef92ce0c15274078a31b23c9b78

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7142.exe

Filesize
468KB

MD5
180e745d79baebf62bafb311df893cc4

SHA1
9b11a36c964e899188564b3551fbb5df63e5272f

SHA256
a815e95a3c0bea3cdbada337922a4be3dd62b02d460f6ff5e3460f3fa0549376

SHA512
bcb2dbf05cbc153909c44daaec5c8d66692d41265a581a312bd3242d041b8c29aff9e24df9957c372b8f7194d8cc538ce9c326c20a14f94a400dbbc864b6dcb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8486.exe

Filesize
468KB

MD5
95888a7b8989c7d58b56b077b26f83e9

SHA1
4482b09ec3c9bdc3e21a3b00cd1979c6751fe9ef

SHA256
37c3487395be198a9fc0827119e7be6503223091a366716b8b9c93cc2a8cc20f

SHA512
1a67ba44b6085ddcba32a3fcbe727a9b57dd146de7fa0e67e5631584bef12cb08a662230b6984256315d18c5628eb8161755c4d5f1b24b638dd183288f8ed799

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8574.exe

Filesize
468KB

MD5
50d7d25f499102629a2c7793d77b89b4

SHA1
00675fcf5017fdbef7cd15a232603d477120abe7

SHA256
997ed97aa21f987553c5d86a64972e5469632c73eb4a1e40701eeffb19873254

SHA512
94d56ee38eed2134dd472bf8f086adef8ce53487eb98177b7f0627ff4f5d441c7d7060fc1403294d9456e0ea36cc2f1e471b1d64311a27b10c96eae33a994310

Download Submit
memory/224-218-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/316-338-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/620-128-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/640-501-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/668-309-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/900-516-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/924-452-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/932-45-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/948-77-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/948-3117-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1124-423-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1280-525-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1376-426-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1436-266-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1584-217-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1688-2306-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1688-56-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1772-422-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1792-94-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1840-65-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1864-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1932-313-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2028-169-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2040-278-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2044-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2120-130-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2132-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2160-149-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2228-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2232-104-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2236-420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2284-314-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2296-186-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2360-343-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2376-168-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2552-351-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2612-481-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2620-230-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2656-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2704-4441-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2724-419-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2780-121-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2872-431-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2876-185-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2896-279-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2940-435-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2976-41-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3008-297-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3168-280-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3176-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3248-244-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3260-91-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3260-3118-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3288-93-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3296-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3336-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3352-138-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3460-400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3520-238-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3552-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3620-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3704-350-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3744-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3748-301-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3764-42-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3764-194-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3912-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3944-253-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3948-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4068-375-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4136-187-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4140-502-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4324-432-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4328-503-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4332-372-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4436-167-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4516-312-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4576-204-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4624-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4628-4440-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4636-434-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4688-68-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4840-256-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4860-458-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4872-257-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4876-328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4900-199-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4936-112-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4960-252-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5000-299-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5152-542-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5168-523-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5212-543-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5220-544-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5264-548-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5272-526-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5284-552-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5372-553-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5384-554-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5396-575-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5408-576-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15932-4478-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16080-3350-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16104-4442-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16428-4475-0x0000000075E10000-0x0000000075E85000-memory.dmp

Filesize
468KB

Download
memory/18664-4543-0x00007FFD66F50000-0x00007FFD67145000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads