99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197

Analysis

max time kernel
129s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2024, 01:25 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe
Size

468KB
MD5

aab702c9ba78bd1175338d32a0f1614d
SHA1

8d4f055cc5d1bff438c5370f138e60438b968e93
SHA256

99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197
SHA512

453c9b6e068a9faa169475e77a76ec544c81bbfeb6edcf8f5515f9d2b703086ebe1cfed5d5485ff70df22ad3aeea5709e39d248a77db51b4ff7c83633834dab2
SSDEEP

3072:ZTANoSCVIduUUbYBPzt1cf8/iCMktgpwVmHeevsMUAu8LTkaQTld:ZTqoQMUUiPJ1cfmcQeUAnnkaQ

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
116	Unicorn-49904.exe
1592	Unicorn-35312.exe
4432	Unicorn-29343.exe
4248	Unicorn-31545.exe
4936	Unicorn-11487.exe
2576	Unicorn-64217.exe
5072	Unicorn-40132.exe
5108	Unicorn-10712.exe
4416	Unicorn-8636.exe
2556	Unicorn-35897.exe
3472	Unicorn-14499.exe
2844	Unicorn-35705.exe
5044	Unicorn-3032.exe
4624	Unicorn-33820.exe
4076	Unicorn-22503.exe
4908	Unicorn-49945.exe
2188	Unicorn-49239.exe
5004	Unicorn-44007.exe
3344	Unicorn-50137.exe
2408	Unicorn-7407.exe
2984	Unicorn-21305.exe
3668	Unicorn-21039.exe
5064	Unicorn-31615.exe
3792	Unicorn-51481.exe
2028	Unicorn-64672.exe
3452	Unicorn-12870.exe
1876	Unicorn-10070.exe
4580	Unicorn-16368.exe
1504	Unicorn-29942.exe
3220	Unicorn-15189.exe
1868	Unicorn-57575.exe
3068	Unicorn-43840.exe
4676	Unicorn-63705.exe
1064	Unicorn-63705.exe
4396	Unicorn-20710.exe
1068	Unicorn-59687.exe
2456	Unicorn-45952.exe
5080	Unicorn-45952.exe
3196	Unicorn-23929.exe
444	Unicorn-9045.exe
1740	Unicorn-54717.exe
2296	Unicorn-37695.exe
2376	Unicorn-61209.exe
1624	Unicorn-5901.exe
3980	Unicorn-22598.exe
4608	Unicorn-61401.exe
4752	Unicorn-61977.exe
4896	Unicorn-61977.exe
4948	Unicorn-42910.exe
976	Unicorn-3839.exe
4464	Unicorn-29305.exe
1100	Unicorn-29040.exe
4568	Unicorn-42303.exe
3096	Unicorn-17017.exe
3696	Unicorn-60414.exe
640	Unicorn-46679.exe
4424	Unicorn-47577.exe
2508	Unicorn-32694.exe
404	Unicorn-9350.exe
4456	Unicorn-15480.exe
1936	Unicorn-50788.exe
3052	Unicorn-39897.exe
852	Unicorn-20031.exe
4376	Unicorn-27536.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
7524	6096	WerFault.exe	237
5984	4464	WerFault.exe	136
21492	21436	Process not Found	1132
18700	19628	Process not Found	1064
6600	18540	Process not Found	995
11512	9328	Process not Found	475

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27536.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20028.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46747.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49066.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29584.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10562.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34189.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4219.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35298.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64506.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36290.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44048.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17586.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39714.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26166.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5538.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9813.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25385.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49756.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53468.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13359.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-958.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28826.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28826.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1835.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50275.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29413.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37695.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7960.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28531.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50029.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37750.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27711.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44048.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22853.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57997.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27877.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45453.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37418.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21797.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7291.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18163.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54931.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4509.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34131.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43050.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34692.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19979.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6882.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17893.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58788.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46972.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29434.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46051.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54931.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46204.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17828	dwm.exe
Token: SeChangeNotifyPrivilege	17828	dwm.exe
Token: 33	17828	dwm.exe
Token: SeIncBasePriorityPrivilege	17828	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2896	99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe
116	Unicorn-49904.exe
1592	Unicorn-35312.exe
4432	Unicorn-29343.exe
4248	Unicorn-31545.exe
4936	Unicorn-11487.exe
2576	Unicorn-64217.exe
5072	Unicorn-40132.exe
5108	Unicorn-10712.exe
4416	Unicorn-8636.exe
2556	Unicorn-35897.exe
5044	Unicorn-3032.exe
3472	Unicorn-14499.exe
4624	Unicorn-33820.exe
2844	Unicorn-35705.exe
4076	Unicorn-22503.exe
4908	Unicorn-49945.exe
5004	Unicorn-44007.exe
2188	Unicorn-49239.exe
3344	Unicorn-50137.exe
2408	Unicorn-7407.exe
2984	Unicorn-21305.exe
3668	Unicorn-21039.exe
3452	Unicorn-12870.exe
5064	Unicorn-31615.exe
1876	Unicorn-10070.exe
2028	Unicorn-64672.exe
3792	Unicorn-51481.exe
4580	Unicorn-16368.exe
1504	Unicorn-29942.exe
3220	Unicorn-15189.exe
4676	Unicorn-63705.exe
3068	Unicorn-43840.exe
1868	Unicorn-57575.exe
4396	Unicorn-20710.exe
1064	Unicorn-63705.exe
1068	Unicorn-59687.exe
2456	Unicorn-45952.exe
5080	Unicorn-45952.exe
3196	Unicorn-23929.exe
1740	Unicorn-54717.exe
2296	Unicorn-37695.exe
1624	Unicorn-5901.exe
444	Unicorn-9045.exe
2376	Unicorn-61209.exe
4608	Unicorn-61401.exe
3980	Unicorn-22598.exe
4896	Unicorn-61977.exe
976	Unicorn-3839.exe
4752	Unicorn-61977.exe
4948	Unicorn-42910.exe
4464	Unicorn-29305.exe
4568	Unicorn-42303.exe
1100	Unicorn-29040.exe
3096	Unicorn-17017.exe
640	Unicorn-46679.exe
3696	Unicorn-60414.exe
4424	Unicorn-47577.exe
2508	Unicorn-32694.exe
404	Unicorn-9350.exe
4456	Unicorn-15480.exe
1936	Unicorn-50788.exe
3052	Unicorn-39897.exe
4376	Unicorn-27536.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 116	2896	99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe	86
PID 2896 wrote to memory of 116	2896	99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe	86
PID 2896 wrote to memory of 116	2896	99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe	86
PID 116 wrote to memory of 1592	116	Unicorn-49904.exe	87
PID 116 wrote to memory of 1592	116	Unicorn-49904.exe	87
PID 116 wrote to memory of 1592	116	Unicorn-49904.exe	87
PID 2896 wrote to memory of 4432	2896	99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe	88
PID 2896 wrote to memory of 4432	2896	99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe	88
PID 2896 wrote to memory of 4432	2896	99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe	88
PID 1592 wrote to memory of 4248	1592	Unicorn-35312.exe	89
PID 1592 wrote to memory of 4248	1592	Unicorn-35312.exe	89
PID 1592 wrote to memory of 4248	1592	Unicorn-35312.exe	89
PID 116 wrote to memory of 4936	116	Unicorn-49904.exe	90
PID 116 wrote to memory of 4936	116	Unicorn-49904.exe	90
PID 116 wrote to memory of 4936	116	Unicorn-49904.exe	90
PID 4432 wrote to memory of 2576	4432	Unicorn-29343.exe	91
PID 4432 wrote to memory of 2576	4432	Unicorn-29343.exe	91
PID 4432 wrote to memory of 2576	4432	Unicorn-29343.exe	91
PID 2896 wrote to memory of 5072	2896	99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe	92
PID 2896 wrote to memory of 5072	2896	99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe	92
PID 2896 wrote to memory of 5072	2896	99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe	92
PID 4248 wrote to memory of 5108	4248	Unicorn-31545.exe	93
PID 4248 wrote to memory of 5108	4248	Unicorn-31545.exe	93
PID 4248 wrote to memory of 5108	4248	Unicorn-31545.exe	93
PID 1592 wrote to memory of 4416	1592	Unicorn-35312.exe	94
PID 1592 wrote to memory of 4416	1592	Unicorn-35312.exe	94
PID 1592 wrote to memory of 4416	1592	Unicorn-35312.exe	94
PID 4936 wrote to memory of 2556	4936	Unicorn-11487.exe	95
PID 4936 wrote to memory of 2556	4936	Unicorn-11487.exe	95
PID 4936 wrote to memory of 2556	4936	Unicorn-11487.exe	95
PID 116 wrote to memory of 3472	116	Unicorn-49904.exe	96
PID 116 wrote to memory of 3472	116	Unicorn-49904.exe	96
PID 116 wrote to memory of 3472	116	Unicorn-49904.exe	96
PID 2576 wrote to memory of 2844	2576	Unicorn-64217.exe	97
PID 2576 wrote to memory of 2844	2576	Unicorn-64217.exe	97
PID 2576 wrote to memory of 2844	2576	Unicorn-64217.exe	97
PID 5072 wrote to memory of 5044	5072	Unicorn-40132.exe	98
PID 5072 wrote to memory of 5044	5072	Unicorn-40132.exe	98
PID 5072 wrote to memory of 5044	5072	Unicorn-40132.exe	98
PID 4432 wrote to memory of 4624	4432	Unicorn-29343.exe	99
PID 4432 wrote to memory of 4624	4432	Unicorn-29343.exe	99
PID 4432 wrote to memory of 4624	4432	Unicorn-29343.exe	99
PID 2896 wrote to memory of 4076	2896	99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe	100
PID 2896 wrote to memory of 4076	2896	99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe	100
PID 2896 wrote to memory of 4076	2896	99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe	100
PID 5108 wrote to memory of 4908	5108	Unicorn-10712.exe	101
PID 5108 wrote to memory of 4908	5108	Unicorn-10712.exe	101
PID 5108 wrote to memory of 4908	5108	Unicorn-10712.exe	101
PID 4248 wrote to memory of 2188	4248	Unicorn-31545.exe	102
PID 4248 wrote to memory of 2188	4248	Unicorn-31545.exe	102
PID 4248 wrote to memory of 2188	4248	Unicorn-31545.exe	102
PID 1592 wrote to memory of 5004	1592	Unicorn-35312.exe	103
PID 1592 wrote to memory of 5004	1592	Unicorn-35312.exe	103
PID 1592 wrote to memory of 5004	1592	Unicorn-35312.exe	103
PID 4416 wrote to memory of 3344	4416	Unicorn-8636.exe	104
PID 4416 wrote to memory of 3344	4416	Unicorn-8636.exe	104
PID 4416 wrote to memory of 3344	4416	Unicorn-8636.exe	104
PID 3472 wrote to memory of 2408	3472	Unicorn-14499.exe	105
PID 3472 wrote to memory of 2408	3472	Unicorn-14499.exe	105
PID 3472 wrote to memory of 2408	3472	Unicorn-14499.exe	105
PID 2556 wrote to memory of 2984	2556	Unicorn-35897.exe	106
PID 2556 wrote to memory of 2984	2556	Unicorn-35897.exe	106
PID 2556 wrote to memory of 2984	2556	Unicorn-35897.exe	106
PID 116 wrote to memory of 3668	116	Unicorn-49904.exe	107

C:\Users\Admin\AppData\Local\Temp\99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe
"C:\Users\Admin\AppData\Local\Temp\99c128f4b2f2d8219a8f1c64e7ca37f00f5a5438e426456839c2e1fae1dea197.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49904.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49904.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35312.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35312.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31545.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10712.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49945.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16368.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17017.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29721.exe
        9⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25744.exe
        10⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24892.exe
        11⤵
        
        PID:8992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6715.exe
        12⤵
        
        PID:10316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8450.exe
        12⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28826.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:13664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36243.exe
        11⤵
        
        PID:19820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23682.exe
        10⤵
        
        PID:9408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52310.exe
        10⤵
        
        PID:14580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35740.exe
        10⤵
        
        PID:19132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43766.exe
        9⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37340.exe
        10⤵
        
        PID:11260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48582.exe
        10⤵
        
        PID:14456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53258.exe
        10⤵
        
        PID:18640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31209.exe
        9⤵
        
        PID:11216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2645.exe
        9⤵
        
        PID:14472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50458.exe
        9⤵
        
        PID:18304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10047.exe
        8⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45142.exe
        9⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32037.exe
        10⤵
        
        PID:9844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63995.exe
        10⤵
        
        PID:14244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4338.exe
        10⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47092.exe
        9⤵
        
        PID:9808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20201.exe
        9⤵
        
        PID:14032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54800.exe
        9⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20579.exe
        8⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40156.exe
        9⤵
        
        PID:12000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14309.exe
        9⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13141.exe
        8⤵
        
        PID:10616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30041.exe
        8⤵
        
        PID:15084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6626.exe
        8⤵
        
        PID:18552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46679.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55097.exe
        8⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13237.exe
        9⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5538.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:9244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55547.exe
        10⤵
        
        PID:14972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44406.exe
        10⤵
        
        PID:19196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34131.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:10108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33865.exe
        9⤵
        
        PID:14844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38672.exe
        9⤵
        
        PID:20236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22687.exe
        8⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57997.exe
        9⤵
        
        PID:13152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35199.exe
        9⤵
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51034.exe
        8⤵
        
        PID:12364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50243.exe
        8⤵
        
        PID:18004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4509.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41785.exe
        8⤵
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21797.exe
        8⤵
        
        PID:10596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4911.exe
        8⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38259.exe
        7⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4667.exe
        8⤵
        
        PID:11192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20979.exe
        8⤵
        
        PID:16176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38183.exe
        8⤵
        
        PID:18748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42842.exe
        7⤵
        
        PID:11560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48482.exe
        7⤵
        
        PID:16568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7147.exe
        7⤵
        
        PID:17708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29942.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47577.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54137.exe
        8⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-824.exe
        9⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50460.exe
        10⤵
        
        PID:9312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52475.exe
        10⤵
        
        PID:14528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3762.exe
        10⤵
        
        PID:19344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29434.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:10988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18706.exe
        9⤵
        
        PID:16272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50458.exe
        9⤵
        
        PID:18528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6844.exe
        8⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20796.exe
        9⤵
        
        PID:10448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41098.exe
        9⤵
        
        PID:15784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52979.exe
        9⤵
        
        PID:19772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7276.exe
        8⤵
        
        PID:10612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39475.exe
        8⤵
        
        PID:15872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31734.exe
        8⤵
        
        PID:19756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35231.exe
        7⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46204.exe
        8⤵
        
        PID:7632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5755.exe
        9⤵
        
        PID:13044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16834.exe
        9⤵
        
        PID:19248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64340.exe
        8⤵
        
        PID:11320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45264.exe
        8⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10650.exe
        7⤵
        
        PID:8488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4219.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14530.exe
        8⤵
        
        PID:18044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32740.exe
        7⤵
        
        PID:12356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42266.exe
        7⤵
        
        PID:3796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50788.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56441.exe
        7⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-824.exe
        8⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4030.exe
        9⤵
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60255.exe
        10⤵
        
        PID:14444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39522.exe
        10⤵
        
        PID:20088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29683.exe
        9⤵
        
        PID:13480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
        9⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12997.exe
        8⤵
        
        PID:9520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36543.exe
        9⤵
        
        PID:16372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17893.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:19512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47690.exe
        8⤵
        
        PID:13760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4338.exe
        8⤵
        
        PID:17752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6844.exe
        7⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41869.exe
        8⤵
        
        PID:14240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20799.exe
        8⤵
        
        PID:19736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12594.exe
        7⤵
        
        PID:11936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46266.exe
        7⤵
        
        PID:16128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10543.exe
        6⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6096 -s 720
        7⤵
        Program crash
        
        PID:7524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45370.exe
        6⤵
        
        PID:8728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
        6⤵
        
        PID:12872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46665.exe
        6⤵
        
        PID:2016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49239.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63705.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38937.exe
        7⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46553.exe
        8⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7960.exe
        9⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7291.exe
        10⤵
        
        PID:11960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21221.exe
        10⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42474.exe
        9⤵
        
        PID:11456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
        9⤵
        
        PID:15100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50563.exe
        8⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57596.exe
        9⤵
        
        PID:21248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42678.exe
        8⤵
        
        PID:12776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5983.exe
        8⤵
        
        PID:20680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31907.exe
        7⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37340.exe
        8⤵
        
        PID:9052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27362.exe
        8⤵
        
        PID:15636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        8⤵
        
        PID:17756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45331.exe
        7⤵
        
        PID:10660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4618.exe
        7⤵
        
        PID:15548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18847.exe
        7⤵
        
        PID:19232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6134.exe
        6⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33206.exe
        7⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46204.exe
        8⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36540.exe
        9⤵
        
        PID:20868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63572.exe
        8⤵
        
        PID:11204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45264.exe
        8⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62452.exe
        7⤵
        
        PID:8528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26874.exe
        7⤵
        
        PID:12416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6447.exe
        7⤵
        
        PID:2292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19613.exe
        6⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61119.exe
        7⤵
        
        PID:9576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33954.exe
        7⤵
        
        PID:13752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64010.exe
        7⤵
        
        PID:2640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26634.exe
        6⤵
        
        PID:11012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2914.exe
        6⤵
        
        PID:15804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35913.exe
        6⤵
        
        PID:18472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57575.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27536.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23001.exe
        7⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7960.exe
        8⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49087.exe
        9⤵
        
        PID:12884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34623.exe
        9⤵
        
        PID:19316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36083.exe
        8⤵
        
        PID:11032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46957.exe
        8⤵
        
        PID:16140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21138.exe
        8⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50563.exe
        7⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36540.exe
        8⤵
        
        PID:20884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22380.exe
        7⤵
        
        PID:12180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
        7⤵
        
        PID:16464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44477.exe
        6⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22463.exe
        7⤵
        
        PID:7964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53468.exe
        8⤵
        
        PID:10516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41098.exe
        8⤵
        
        PID:15540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44048.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:19372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6530.exe
        7⤵
        
        PID:11052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23194.exe
        7⤵
        
        PID:16400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4911.exe
        7⤵
        
        PID:3556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48170.exe
        6⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43836.exe
        7⤵
        
        PID:14292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61344.exe
        7⤵
        
        PID:19604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49284.exe
        6⤵
        
        PID:12860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5983.exe
        6⤵
        
        PID:20688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30733.exe
        5⤵
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18832.exe
        6⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20604.exe
        7⤵
        
        PID:10464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41098.exe
        7⤵
        
        PID:15168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44048.exe
        7⤵
        
        PID:19400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6882.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55690.exe
        6⤵
        
        PID:15280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31827.exe
        6⤵
        
        PID:20072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1244.exe
        5⤵
        
        PID:6448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4219.exe
        6⤵
        
        PID:13264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46627.exe
        6⤵
        
        PID:18208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5006.exe
        5⤵
        
        PID:10504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56020.exe
        5⤵
        
        PID:16096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9047.exe
        5⤵
        
        PID:18956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8636.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50137.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15189.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39897.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1519.exe
        8⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46204.exe
        9⤵
        
        PID:7500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3867.exe
        10⤵
        
        PID:14772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24447.exe
        10⤵
        
        PID:18996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58964.exe
        9⤵
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50029.exe
        9⤵
        
        PID:16488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36048.exe
        9⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62452.exe
        8⤵
        
        PID:8536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26874.exe
        8⤵
        
        PID:12424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35856.exe
        8⤵
        
        PID:16668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2038.exe
        7⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52188.exe
        8⤵
        
        PID:8408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52475.exe
        8⤵
        
        PID:14544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59123.exe
        8⤵
        
        PID:18116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39914.exe
        7⤵
        
        PID:9592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9699.exe
        7⤵
        
        PID:13792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62170.exe
        7⤵
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7670.exe
        6⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15416.exe
        7⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7960.exe
        8⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3867.exe
        9⤵
        
        PID:14724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29247.exe
        9⤵
        
        PID:18448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42474.exe
        8⤵
        
        PID:12116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45866.exe
        7⤵
        
        PID:8548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54899.exe
        7⤵
        
        PID:13604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46135.exe
        7⤵
        
        PID:17476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15773.exe
        6⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53286.exe
        7⤵
        
        PID:8560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55547.exe
        7⤵
        
        PID:14980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44406.exe
        7⤵
        
        PID:19100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36290.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55665.exe
        6⤵
        
        PID:1220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43840.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32694.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49568.exe
        7⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15067.exe
        8⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44582.exe
        9⤵
        
        PID:12140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30950.exe
        9⤵
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21797.exe
        8⤵
        
        PID:11028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23194.exe
        8⤵
        
        PID:16416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40464.exe
        8⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64298.exe
        7⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34012.exe
        7⤵
        
        PID:12684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12578.exe
        7⤵
        
        PID:19680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46013.exe
        6⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46204.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
        8⤵
        
        PID:11472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13929.exe
        8⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10562.exe
        7⤵
        
        PID:11356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9272.exe
        8⤵
        
        PID:21256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37750.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10650.exe
        6⤵
        
        PID:8456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46716.exe
        7⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39714.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32740.exe
        6⤵
        
        PID:12348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44730.exe
        6⤵
        
        PID:16300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9350.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53561.exe
        6⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50518.exe
        7⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13708.exe
        8⤵
        
        PID:9024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11650.exe
        8⤵
        
        PID:13108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44519.exe
        8⤵
        
        PID:18184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23682.exe
        7⤵
        
        PID:9268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52310.exe
        7⤵
        
        PID:14588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35382.exe
        7⤵
        
        PID:19560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42780.exe
        6⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42747.exe
        6⤵
        
        PID:8416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34189.exe
        7⤵
        
        PID:14628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39714.exe
        7⤵
        
        PID:19216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43731.exe
        6⤵
        
        PID:12292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46266.exe
        6⤵
        
        PID:16604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21638.exe
        5⤵
        
        PID:6240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46204.exe
        6⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29314.exe
        7⤵
        
        PID:11448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49066.exe
        7⤵
        
        PID:16536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21029.exe
        6⤵
        
        PID:10760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4911.exe
        6⤵
        
        PID:17384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7850.exe
        5⤵
        
        PID:8476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7539.exe
        5⤵
        
        PID:12408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61545.exe
        5⤵
        
        PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44007.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63705.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12175.exe
        7⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56.exe
        8⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-958.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35298.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53258.exe
        9⤵
        
        PID:20060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8521.exe
        8⤵
        
        PID:11068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28115.exe
        8⤵
        
        PID:15792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4121.exe
        8⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6844.exe
        7⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40156.exe
        8⤵
        
        PID:11548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64963.exe
        8⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46747.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39475.exe
        7⤵
        
        PID:15888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50458.exe
        7⤵
        
        PID:20104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26687.exe
        6⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7960.exe
        7⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60095.exe
        8⤵
        
        PID:10544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41098.exe
        8⤵
        
        PID:15744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44048.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:18520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21797.exe
        7⤵
        
        PID:11252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23194.exe
        7⤵
        
        PID:16424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36048.exe
        7⤵
        
        PID:1072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64298.exe
        6⤵
        
        PID:8132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45267.exe
        6⤵
        
        PID:11972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59805.exe
        6⤵
        
        PID:16364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20031.exe
        5⤵
        Executes dropped EXE
        
        PID:852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55865.exe
        6⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46396.exe
        7⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52934.exe
        7⤵
        
        PID:10336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50029.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17586.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8098.exe
        6⤵
        
        PID:8436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57997.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50275.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26874.exe
        6⤵
        
        PID:12432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11698.exe
        6⤵
        
        PID:16672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40423.exe
        5⤵
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17087.exe
        6⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60095.exe
        7⤵
        
        PID:10532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35516.exe
        8⤵
        
        PID:18256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41098.exe
        7⤵
        
        PID:14028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44048.exe
        7⤵
        
        PID:19612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34601.exe
        6⤵
        
        PID:11768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
        6⤵
        
        PID:16608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63926.exe
        5⤵
        
        PID:9096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22585.exe
        5⤵
        
        PID:13000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44674.exe
        5⤵
        
        PID:17796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20710.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5688.exe
        5⤵
        
        PID:1904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15416.exe
        6⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7960.exe
        7⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9612.exe
        8⤵
        
        PID:10576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41098.exe
        8⤵
        
        PID:15392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44048.exe
        8⤵
        
        PID:19628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42474.exe
        7⤵
        
        PID:12132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
        7⤵
        
        PID:16340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-293.exe
        6⤵
        
        PID:8020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42678.exe
        6⤵
        
        PID:12608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57370.exe
        6⤵
        
        PID:18284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33532.exe
        5⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44191.exe
        6⤵
        
        PID:8304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6875.exe
        7⤵
        
        PID:15948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39522.exe
        7⤵
        
        PID:17932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
        6⤵
        
        PID:11412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49066.exe
        6⤵
        
        PID:16164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58523.exe
        5⤵
        
        PID:9220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5205.exe
        5⤵
        
        PID:13684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9814.exe
        5⤵
        
        PID:18308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49166.exe
      4⤵
      PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4591.exe
        5⤵
        
        PID:5228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22463.exe
        6⤵
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52700.exe
        7⤵
        
        PID:10420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1363.exe
        7⤵
        
        PID:15428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53258.exe
        7⤵
        
        PID:18648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43050.exe
        6⤵
        
        PID:11748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
        6⤵
        
        PID:16600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6275.exe
        5⤵
        
        PID:9720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36060.exe
        5⤵
        
        PID:15320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
        5⤵
        
        PID:18176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
      4⤵
      PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10459.exe
        5⤵
        
        PID:7724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38364.exe
        6⤵
        
        PID:8352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30882.exe
        6⤵
        
        PID:14000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41255.exe
        6⤵
        
        PID:18796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50214.exe
        5⤵
        
        PID:10196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38861.exe
        5⤵
        
        PID:15328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44048.exe
        5⤵
        
        PID:19496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49164.exe
      4⤵
      PID:9060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7867.exe
        5⤵
        
        PID:17832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1585.exe
      4⤵
      PID:12992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1242.exe
      4⤵
      PID:19840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11487.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11487.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35897.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21305.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9045.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21392.exe
        7⤵
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25526.exe
        8⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32086.exe
        9⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36316.exe
        10⤵
        
        PID:13096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57379.exe
        10⤵
        
        PID:17940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-339.exe
        9⤵
        
        PID:10540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
        9⤵
        
        PID:16508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13811.exe
        8⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42111.exe
        9⤵
        
        PID:17912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48714.exe
        8⤵
        
        PID:11760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
        8⤵
        
        PID:16360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17106.exe
        7⤵
        
        PID:7612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7291.exe
        8⤵
        
        PID:11632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24127.exe
        8⤵
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8970.exe
        7⤵
        
        PID:11228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1835.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65527.exe
        6⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45785.exe
        7⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7960.exe
        8⤵
        
        PID:7268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12315.exe
        9⤵
        
        PID:14480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24447.exe
        9⤵
        
        PID:18988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43050.exe
        8⤵
        
        PID:11500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50563.exe
        7⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21273.exe
        8⤵
        
        PID:20944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39402.exe
        7⤵
        
        PID:12016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
        7⤵
        
        PID:16084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33318.exe
        6⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18061.exe
        7⤵
        
        PID:9448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43347.exe
        7⤵
        
        PID:8780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38541.exe
        7⤵
        
        PID:17984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57204.exe
        6⤵
        
        PID:11404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40782.exe
        6⤵
        
        PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37695.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23696.exe
        6⤵
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1400.exe
        7⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62172.exe
        8⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43507.exe
        8⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49066.exe
        8⤵
        
        PID:16636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8389.exe
        7⤵
        
        PID:9564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23940.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30774.exe
        7⤵
        
        PID:19424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52640.exe
        6⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38893.exe
        7⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52475.exe
        7⤵
        
        PID:14536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13103.exe
        7⤵
        
        PID:19172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47867.exe
        6⤵
        
        PID:10020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39731.exe
        6⤵
        
        PID:14852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31644.exe
        6⤵
        
        PID:21192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18333.exe
        5⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36377.exe
        6⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40060.exe
        7⤵
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7291.exe
        8⤵
        
        PID:11744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35330.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34978.exe
        7⤵
        
        PID:11752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49066.exe
        7⤵
        
        PID:15924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1762.exe
        6⤵
        
        PID:8792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21737.exe
        6⤵
        
        PID:12904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18479.exe
        6⤵
        
        PID:18336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23725.exe
        5⤵
        
        PID:6468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61119.exe
        6⤵
        
        PID:9608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55636.exe
        6⤵
        
        PID:13780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12614.exe
        6⤵
        
        PID:18352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45067.exe
        5⤵
        
        PID:10168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14530.exe
        5⤵
        
        PID:15008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39945.exe
        5⤵
        
        PID:19640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31615.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61977.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19856.exe
        6⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45785.exe
        7⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1935.exe
        8⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49692.exe
        9⤵
        
        PID:9164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36540.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:20912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28826.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37971.exe
        9⤵
        
        PID:17936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58275.exe
        8⤵
        
        PID:9756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40077.exe
        9⤵
        
        PID:16248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-706.exe
        9⤵
        
        PID:19860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7634.exe
        8⤵
        
        PID:15076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35382.exe
        8⤵
        
        PID:19392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3738.exe
        7⤵
        
        PID:8680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9813.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26809.exe
        7⤵
        
        PID:18120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49779.exe
        6⤵
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1403.exe
        7⤵
        
        PID:10960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33221.exe
        7⤵
        
        PID:16300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13161.exe
        7⤵
        
        PID:1664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42842.exe
        6⤵
        
        PID:11568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5224.exe
        6⤵
        
        PID:8376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32669.exe
        5⤵
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32447.exe
        6⤵
        
        PID:7560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63572.exe
        6⤵
        
        PID:10896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46032.exe
        6⤵
        
        PID:544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27507.exe
        5⤵
        
        PID:8520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24074.exe
        5⤵
        
        PID:12392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52928.exe
        5⤵
        
        PID:1956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42910.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54614.exe
        5⤵
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53398.exe
        6⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15644.exe
        7⤵
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26815.exe
        8⤵
        
        PID:12368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33378.exe
        8⤵
        
        PID:19808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56006.exe
        7⤵
        
        PID:11372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2281.exe
        7⤵
        
        PID:16656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49491.exe
        7⤵
        
        PID:1848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3490.exe
        6⤵
        
        PID:8656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3948.exe
        6⤵
        
        PID:12804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54800.exe
        6⤵
        
        PID:3496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4124.exe
        5⤵
        
        PID:6488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34285.exe
        6⤵
        
        PID:9632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59476.exe
        6⤵
        
        PID:13816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45095.exe
        6⤵
        
        PID:18272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52826.exe
        5⤵
        
        PID:11460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14850.exe
        5⤵
        
        PID:16436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10699.exe
        5⤵
        
        PID:2624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34832.exe
      4⤵
      PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34265.exe
        5⤵
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46972.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8475.exe
        7⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9922.exe
        7⤵
        
        PID:18932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21797.exe
        6⤵
        
        PID:8736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46032.exe
        6⤵
        
        PID:1708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35077.exe
        5⤵
        
        PID:7848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49756.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45642.exe
        5⤵
        
        PID:11552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62957.exe
        6⤵
        
        PID:15612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57187.exe
        6⤵
        
        PID:17896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8146.exe
        5⤵
        
        PID:16560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25942.exe
        5⤵
        
        PID:17444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12755.exe
      4⤵
      PID:6592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3006.exe
        5⤵
        
        PID:10396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41098.exe
        5⤵
        
        PID:10800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59123.exe
        5⤵
        
        PID:18372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28531.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43778.exe
      4⤵
      PID:14720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58330.exe
      4⤵
      PID:4764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14499.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14499.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7407.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23929.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10296.exe
        6⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19065.exe
        7⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7195.exe
        8⤵
        
        PID:8008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4418.exe
        8⤵
        
        PID:11728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33606.exe
        8⤵
        
        PID:15716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34434.exe
        7⤵
        
        PID:8756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43419.exe
        7⤵
        
        PID:10720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50960.exe
        7⤵
        
        PID:18260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5878.exe
        6⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32380.exe
        7⤵
        
        PID:8608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31449.exe
        8⤵
        
        PID:20852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46051.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19526.exe
        7⤵
        
        PID:17776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37418.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52159.exe
        7⤵
        
        PID:13136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50275.exe
        7⤵
        
        PID:18428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43645.exe
        6⤵
        
        PID:14568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18847.exe
        6⤵
        
        PID:19552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5916.exe
        5⤵
        
        PID:3024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58198.exe
        6⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7960.exe
        7⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34189.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27711.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:19016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62150.exe
        7⤵
        
        PID:10876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
        7⤵
        
        PID:16520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53038.exe
        7⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50563.exe
        6⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39402.exe
        6⤵
        
        PID:12008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
        6⤵
        
        PID:16256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41114.exe
        5⤵
        
        PID:8000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36892.exe
        6⤵
        
        PID:13196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29413.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64355.exe
        5⤵
        
        PID:11716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62281.exe
        5⤵
        
        PID:16644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54717.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1080.exe
        5⤵
        
        PID:2472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58198.exe
        6⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18317.exe
        7⤵
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61603.exe
        7⤵
        
        PID:11584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24902.exe
        7⤵
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56547.exe
        6⤵
        
        PID:9344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64877.exe
        6⤵
        
        PID:13700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37494.exe
        6⤵
        
        PID:19528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22681.exe
        5⤵
        
        PID:8588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22853.exe
        5⤵
        
        PID:12712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41356.exe
        5⤵
        
        PID:4560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28198.exe
      4⤵
      PID:3492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31888.exe
        5⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34876.exe
        6⤵
        
        PID:7556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27778.exe
        6⤵
        
        PID:11880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49066.exe
        6⤵
        
        PID:16444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44326.exe
        5⤵
        
        PID:9080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25385.exe
        5⤵
        
        PID:12976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50384.exe
        5⤵
        
        PID:18200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25479.exe
      4⤵
      PID:6408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61119.exe
        5⤵
        
        PID:9620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53446.exe
        5⤵
        
        PID:13832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12614.exe
        5⤵
        
        PID:17492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45067.exe
      4⤵
      PID:10180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65309.exe
      4⤵
      PID:15224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29457.exe
      4⤵
      PID:18808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21039.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21039.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36284.exe
      4⤵
      PID:2312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19065.exe
        5⤵
        
        PID:1252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46204.exe
        6⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36237.exe
        7⤵
        
        PID:15896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-706.exe
        7⤵
        
        PID:19792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26867.exe
        6⤵
        
        PID:10584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45264.exe
        6⤵
        
        PID:2900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62452.exe
        5⤵
        
        PID:8620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60554.exe
        5⤵
        
        PID:12824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1266.exe
        5⤵
        
        PID:18032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37773.exe
      4⤵
      PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53468.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41098.exe
        5⤵
        
        PID:15412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44048.exe
        5⤵
        
        PID:18584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4185.exe
      4⤵
      PID:10676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53620.exe
      4⤵
      PID:15556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50988.exe
      4⤵
      PID:18488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5901.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5901.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36633.exe
      4⤵
      PID:2488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36569.exe
        5⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34876.exe
        6⤵
        
        PID:7856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29244.exe
        7⤵
        
        PID:9440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43347.exe
        7⤵
        
        PID:13800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64778.exe
        7⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17349.exe
        6⤵
        
        PID:10288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27433.exe
        6⤵
        
        PID:13508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59123.exe
        6⤵
        
        PID:18280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62115.exe
        5⤵
        
        PID:9132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25385.exe
        5⤵
        
        PID:13116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35475.exe
        5⤵
        
        PID:18140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4124.exe
      4⤵
      PID:6480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19853.exe
        5⤵
        
        PID:8640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33829.exe
        5⤵
        
        PID:12940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52199.exe
        5⤵
        
        PID:17800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60827.exe
      4⤵
      PID:9816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26067.exe
      4⤵
      PID:14044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29113.exe
      4⤵
      PID:19692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29148.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29148.exe
    3⤵
    PID:2912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51286.exe
      4⤵
      PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1726.exe
        5⤵
        
        PID:8328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43170.exe
        5⤵
        
        PID:13456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53258.exe
        5⤵
        
        PID:18148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31059.exe
      4⤵
      PID:9588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57083.exe
      4⤵
      PID:12512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21551.exe
      4⤵
      PID:18972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15880.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15880.exe
    3⤵
    PID:6608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20604.exe
      4⤵
      PID:10476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41098.exe
      4⤵
      PID:15764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59123.exe
      4⤵
      PID:18364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53905.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53905.exe
    3⤵
    PID:10120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42397.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42397.exe
    3⤵
    PID:15352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28322.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28322.exe
    3⤵
    PID:18664
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29343.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29343.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64217.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64217.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35705.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45952.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38169.exe
        6⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40790.exe
        7⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7960.exe
        8⤵
        
        PID:7180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29477.exe
        8⤵
        
        PID:10808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14284.exe
        8⤵
        
        PID:16364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33910.exe
        8⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50563.exe
        7⤵
        
        PID:7384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7291.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35330.exe
        8⤵
        
        PID:16544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27564.exe
        7⤵
        
        PID:10968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
        7⤵
        
        PID:16492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34902.exe
        6⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40947.exe
        7⤵
        
        PID:8632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13289.exe
        7⤵
        
        PID:13532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12370.exe
        7⤵
        
        PID:21352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6473.exe
        6⤵
        
        PID:9784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44604.exe
        7⤵
        
        PID:14428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35106.exe
        7⤵
        
        PID:19572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64506.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4130.exe
        6⤵
        
        PID:19032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51966.exe
        5⤵
        
        PID:4516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51737.exe
        6⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7195.exe
        7⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44828.exe
        8⤵
        
        PID:10600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65514.exe
        8⤵
        
        PID:13884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59315.exe
        8⤵
        
        PID:18888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21797.exe
        7⤵
        
        PID:11096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23194.exe
        7⤵
        
        PID:16392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49491.exe
        7⤵
        
        PID:760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18170.exe
        6⤵
        
        PID:10144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64598.exe
        6⤵
        
        PID:14296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9814.exe
        6⤵
        
        PID:18316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29107.exe
        5⤵
        
        PID:7116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35167.exe
        6⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34268.exe
        7⤵
        
        PID:11008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55619.exe
        7⤵
        
        PID:15860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53258.exe
        7⤵
        
        PID:18540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55124.exe
        6⤵
        
        PID:11492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19794.exe
        6⤵
        
        PID:1104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24037.exe
        5⤵
        
        PID:9800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25021.exe
        5⤵
        
        PID:14344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29457.exe
        5⤵
        
        PID:18228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64672.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61209.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16566.exe
        6⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12152.exe
        7⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25174.exe
        8⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25325.exe
        9⤵
        
        PID:13184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55843.exe
        9⤵
        
        PID:17960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21797.exe
        8⤵
        
        PID:11084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23194.exe
        8⤵
        
        PID:16408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15282.exe
        8⤵
        
        PID:17612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32965.exe
        7⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4219.exe
        8⤵
        
        PID:13300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-415.exe
        8⤵
        
        PID:18092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39402.exe
        7⤵
        
        PID:12032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39472.exe
        7⤵
        
        PID:15944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22681.exe
        6⤵
        
        PID:8580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22853.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31753.exe
        6⤵
        
        PID:4660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58788.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35213.exe
        6⤵
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34957.exe
        7⤵
        
        PID:14040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39714.exe
        7⤵
        
        PID:18896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38634.exe
        6⤵
        
        PID:12472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35856.exe
        6⤵
        
        PID:16480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16515.exe
        5⤵
        
        PID:8512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24074.exe
        5⤵
        
        PID:12400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28802.exe
        5⤵
        
        PID:452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22598.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-888.exe
        5⤵
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12344.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1819.exe
        7⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25666.exe
        7⤵
        
        PID:10828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49066.exe
        7⤵
        
        PID:16528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44326.exe
        6⤵
        
        PID:9088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36540.exe
        7⤵
        
        PID:20904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34692.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61978.exe
        6⤵
        
        PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22681.exe
        5⤵
        
        PID:8596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22853.exe
        5⤵
        
        PID:12704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2347.exe
        5⤵
        
        PID:17860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16300.exe
      4⤵
      PID:800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58198.exe
        5⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42789.exe
        6⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41869.exe
        7⤵
        
        PID:13812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49923.exe
        7⤵
        
        PID:20924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40653.exe
        6⤵
        
        PID:13072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22518.exe
        6⤵
        
        PID:20700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4834.exe
        5⤵
        
        PID:9044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36540.exe
        6⤵
        
        PID:20932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25385.exe
        5⤵
        
        PID:13292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22518.exe
        5⤵
        
        PID:20708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62807.exe
      4⤵
      PID:6292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35100.exe
        5⤵
        
        PID:10160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46716.exe
        6⤵
        
        PID:14376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39522.exe
        6⤵
        
        PID:18608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18163.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31184.exe
        5⤵
        
        PID:20728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40098.exe
      4⤵
      PID:9980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12507.exe
        5⤵
        
        PID:14604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18661.exe
        5⤵
        
        PID:20184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31596.exe
      4⤵
      PID:14908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59249.exe
      4⤵
      PID:20292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33820.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33820.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60414.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54137.exe
        5⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33497.exe
        6⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53468.exe
        7⤵
        
        PID:10508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41098.exe
        7⤵
        
        PID:15800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59123.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28755.exe
        6⤵
        
        PID:8752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13595.exe
        7⤵
        
        PID:14836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24447.exe
        7⤵
        
        PID:18860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5228.exe
        6⤵
        
        PID:15268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44048.exe
        6⤵
        
        PID:19592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45303.exe
        5⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23533.exe
        6⤵
        
        PID:10112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62787.exe
        6⤵
        
        PID:12868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32105.exe
        6⤵
        
        PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12937.exe
        5⤵
        
        PID:9628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11861.exe
        5⤵
        
        PID:14372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50458.exe
        5⤵
        
        PID:18632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54832.exe
      4⤵
      PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60985.exe
        5⤵
        
        PID:6836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61325.exe
        6⤵
        
        PID:11168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20979.exe
        6⤵
        
        PID:16196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53258.exe
        6⤵
        
        PID:18128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40322.exe
        5⤵
        
        PID:9444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5228.exe
        5⤵
        
        PID:15248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63248.exe
        5⤵
        
        PID:4656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33622.exe
      4⤵
      PID:6688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9435.exe
        5⤵
        
        PID:13468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43362.exe
        5⤵
        
        PID:19052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53478.exe
      4⤵
      PID:10428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12014.exe
      4⤵
      PID:16088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6382.exe
      4⤵
      PID:4548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12870.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12870.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61977.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4920.exe
        5⤵
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1400.exe
        6⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64237.exe
        7⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21599.exe
        8⤵
        
        PID:11780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35330.exe
        8⤵
        
        PID:16188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43045.exe
        7⤵
        
        PID:11848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49066.exe
        7⤵
        
        PID:16628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25939.exe
        6⤵
        
        PID:8976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25385.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18479.exe
        6⤵
        
        PID:18296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35743.exe
        5⤵
        
        PID:3440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53286.exe
        6⤵
        
        PID:8484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63513.exe
        7⤵
        
        PID:17456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34633.exe
        6⤵
        
        PID:15040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27987.exe
        6⤵
        
        PID:18912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41986.exe
        5⤵
        
        PID:12628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56364.exe
        5⤵
        
        PID:18560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50400.exe
      4⤵
      PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36377.exe
        5⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9406.exe
        6⤵
        
        PID:8368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38811.exe
        6⤵
        
        PID:13720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50384.exe
        6⤵
        
        PID:18216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8389.exe
        5⤵
        
        PID:9548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27583.exe
        6⤵
        
        PID:14412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24447.exe
        6⤵
        
        PID:19064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47690.exe
        5⤵
        
        PID:13968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54800.exe
        5⤵
        
        PID:4420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17859.exe
      4⤵
      PID:6460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4030.exe
        5⤵
        
        PID:8700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29683.exe
        5⤵
        
        PID:12852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14150.exe
        5⤵
        
        PID:18076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18290.exe
      4⤵
      PID:9068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9272.exe
        5⤵
        
        PID:21236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62077.exe
      4⤵
      PID:13676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40834.exe
      4⤵
      PID:18236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29040.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29040.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21942.exe
      4⤵
      PID:1468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1400.exe
        5⤵
        
        PID:6172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21378.exe
        6⤵
        
        PID:9368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
        7⤵
        
        PID:13828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35106.exe
        7⤵
        
        PID:19264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49034.exe
        6⤵
        
        PID:13588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4338.exe
        6⤵
        
        PID:17640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8389.exe
        5⤵
        
        PID:9556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23940.exe
        5⤵
        
        PID:14684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35382.exe
        5⤵
        
        PID:18728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56055.exe
      4⤵
      PID:6552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8507.exe
        5⤵
        
        PID:9000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18914.exe
        5⤵
        
        PID:15288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53258.exe
        5⤵
        
        PID:18736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41723.exe
      4⤵
      PID:9328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11093.exe
      4⤵
      PID:15256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1017.exe
      4⤵
      PID:15416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20450.exe
      4⤵
      PID:1744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26166.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26166.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55894.exe
      4⤵
      PID:6308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20092.exe
        5⤵
        
        PID:9320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52475.exe
        5⤵
        
        PID:14552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44048.exe
        5⤵
        
        PID:19620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61491.exe
      4⤵
      PID:11436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65018.exe
      4⤵
      PID:16548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40709.exe
      4⤵
      PID:17532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51872.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51872.exe
    3⤵
    PID:5620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53439.exe
      4⤵
      PID:9004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64899.exe
      4⤵
      PID:13348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39309.exe
      4⤵
      PID:19080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32541.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32541.exe
    3⤵
    PID:10340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56834.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56834.exe
    3⤵
    PID:15384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51418.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51418.exe
    3⤵
    PID:20128
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40132.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40132.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3032.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3032.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51481.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29305.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4464
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 640
        6⤵
        Program crash
        
        PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4598.exe
        5⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49911.exe
        6⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55772.exe
        7⤵
        
        PID:8636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41811.exe
        7⤵
        
        PID:14996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38183.exe
        7⤵
        
        PID:19476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35539.exe
        6⤵
        
        PID:10700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11484.exe
        6⤵
        
        PID:16104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8709.exe
        6⤵
        
        PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17859.exe
        5⤵
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20604.exe
        6⤵
        
        PID:10496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40077.exe
        7⤵
        
        PID:16044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-706.exe
        7⤵
        
        PID:19852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41098.exe
        6⤵
        
        PID:15424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44048.exe
        6⤵
        
        PID:18600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53732.exe
        5⤵
        
        PID:10068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31065.exe
        5⤵
        
        PID:14876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34.exe
        5⤵
        
        PID:21180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42303.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16412.exe
        5⤵
        
        PID:432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35213.exe
        6⤵
        
        PID:7528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54431.exe
        7⤵
        
        PID:15116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27877.exe
        7⤵
        
        PID:18716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26867.exe
        6⤵
        
        PID:6540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13359.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10650.exe
        5⤵
        
        PID:8500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40156.exe
        6⤵
        
        PID:12044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46310.exe
        6⤵
        
        PID:17592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32740.exe
        5⤵
        
        PID:12372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37366.exe
        5⤵
        
        PID:1488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28966.exe
      4⤵
      PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49911.exe
        5⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20604.exe
        6⤵
        
        PID:10484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41098.exe
        6⤵
        
        PID:15256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44048.exe
        6⤵
        
        PID:19384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48106.exe
        5⤵
        
        PID:10044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44726.exe
        5⤵
        
        PID:15296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50458.exe
        5⤵
        
        PID:18616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21420.exe
      4⤵
      PID:6580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45084.exe
        5⤵
        
        PID:9736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6466.exe
        5⤵
        
        PID:14016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
        5⤵
        
        PID:17528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45067.exe
      4⤵
      PID:10176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14530.exe
      4⤵
      PID:14892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32175.exe
      4⤵
      PID:21168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59687.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59687.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5688.exe
      4⤵
      PID:696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1519.exe
        5⤵
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60560.exe
        6⤵
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20028.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41098.exe
        7⤵
        
        PID:15516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59766.exe
        7⤵
        
        PID:17924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14402.exe
        6⤵
        
        PID:10984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3817.exe
        6⤵
        
        PID:16172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44883.exe
        6⤵
        
        PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32965.exe
        5⤵
        
        PID:7356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42678.exe
        5⤵
        
        PID:12672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41719.exe
        5⤵
        
        PID:18160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2038.exe
      4⤵
      PID:6272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-841.exe
        5⤵
        
        PID:11144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18706.exe
        5⤵
        
        PID:16076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50650.exe
        5⤵
        
        PID:18824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35300.exe
      4⤵
      PID:11020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19449.exe
      4⤵
      PID:15812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33922.exe
      4⤵
      PID:18436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57831.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57831.exe
    3⤵
    PID:4632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58909.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58909.exe
      4⤵
      PID:6856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29052.exe
        5⤵
        
        PID:9504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44116.exe
        5⤵
        
        PID:14140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45453.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:19896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17737.exe
      4⤵
      PID:8648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61412.exe
      4⤵
      PID:14988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35382.exe
      4⤵
      PID:19484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16813.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16813.exe
    3⤵
    PID:6388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22669.exe
      4⤵
      PID:9728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57219.exe
      4⤵
      PID:13712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64778.exe
      4⤵
      PID:17904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27165.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27165.exe
    3⤵
    PID:10976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43010.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43010.exe
    3⤵
    PID:16120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24122.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24122.exe
    3⤵
    PID:20116
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22503.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22503.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45952.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45952.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23478.exe
      4⤵
      PID:3892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51737.exe
        5⤵
        
        PID:5132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34876.exe
        6⤵
        
        PID:7720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27778.exe
        6⤵
        
        PID:11872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49066.exe
        6⤵
        
        PID:14960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29058.exe
        5⤵
        
        PID:9112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25385.exe
        5⤵
        
        PID:13112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22518.exe
        5⤵
        
        PID:20716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19583.exe
      4⤵
      PID:6532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51228.exe
        5⤵
        
        PID:9492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51068.exe
        6⤵
        
        PID:16260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42786.exe
        6⤵
        
        PID:18872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18074.exe
        5⤵
        
        PID:14664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36435.exe
        5⤵
        
        PID:19292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41986.exe
      4⤵
      PID:12620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22731.exe
      4⤵
      PID:19160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23709.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23709.exe
    3⤵
    PID:3988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58198.exe
      4⤵
      PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46204.exe
        5⤵
        
        PID:7684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10562.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28051.exe
        5⤵
        
        PID:1152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62452.exe
      4⤵
      PID:8464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26874.exe
      4⤵
      PID:12384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58035.exe
      4⤵
      PID:3104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22188.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22188.exe
    3⤵
    PID:6612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2035.exe
      4⤵
      PID:8652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16844.exe
      4⤵
      PID:14948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59315.exe
      4⤵
      PID:18840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54723.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54723.exe
    3⤵
    PID:11056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19979.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19979.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:15820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7828.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7828.exe
    3⤵
    PID:19660
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10070.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10070.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61401.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61401.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19088.exe
      4⤵
      PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29584.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55069.exe
        5⤵
        
        PID:6984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33852.exe
        6⤵
        
        PID:9856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6949.exe
        6⤵
        
        PID:8564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30377.exe
        6⤵
        
        PID:19720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11401.exe
        5⤵
        
        PID:9852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44726.exe
        5⤵
        
        PID:15308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50458.exe
        5⤵
        
        PID:18680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22681.exe
      4⤵
      PID:8572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22853.exe
      4⤵
      PID:12696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41356.exe
      4⤵
      PID:2288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58788.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58788.exe
    3⤵
    PID:5192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40060.exe
      4⤵
      PID:8076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20028.exe
        5⤵
        
        PID:10368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41098.exe
        5⤵
        
        PID:15376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44048.exe
        5⤵
        
        PID:18040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43050.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
      4⤵
      PID:16448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21362.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21362.exe
    3⤵
    PID:8800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62303.exe
      4⤵
      PID:15828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27877.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:18708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18937.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18937.exe
    3⤵
    PID:12924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29599.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29599.exe
    3⤵
    PID:3184
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3839.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3839.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32793.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32793.exe
    3⤵
    PID:4672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60144.exe
      4⤵
      PID:5572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7960.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51580.exe
        6⤵
        
        PID:11596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11721.exe
        6⤵
        
        PID:17496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21797.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23194.exe
        5⤵
        
        PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7602.exe
        5⤵
        
        PID:17740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-293.exe
      4⤵
      PID:7992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34029.exe
        5⤵
        
        PID:10692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4674.exe
        5⤵
        
        PID:15520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38183.exe
        5⤵
        
        PID:18772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36301.exe
      4⤵
      PID:9996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55894.exe
      4⤵
      PID:16476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10169.exe
      4⤵
      PID:16408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49779.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49779.exe
    3⤵
    PID:7584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21273.exe
      4⤵
      PID:20952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8970.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8970.exe
    3⤵
    PID:11272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37897.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37897.exe
    3⤵
    PID:2800
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16063.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16063.exe
  2⤵
  PID:212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49911.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49911.exe
    3⤵
    PID:7000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20092.exe
      4⤵
      PID:9332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52475.exe
      4⤵
      PID:14520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53171.exe
      4⤵
      PID:20196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28489.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28489.exe
    3⤵
    PID:9868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31033.exe
      4⤵
      PID:4468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33156.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33156.exe
    3⤵
    PID:14356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45559.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45559.exe
    3⤵
    PID:19364
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9518.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9518.exe
  2⤵
  PID:6524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13708.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13708.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:9016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55949.exe
      4⤵
      PID:11116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33221.exe
      4⤵
      PID:16348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28044.exe
      4⤵
      PID:512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16979.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16979.exe
    3⤵
    PID:10064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49066.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49066.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:14732
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42874.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42874.exe
  2⤵
  PID:9776
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60803.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60803.exe
  2⤵
  PID:14004
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11338.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11338.exe
  2⤵
  PID:17736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4464 -ip 4464
1⤵
PID:5460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 6096 -ip 6096
1⤵
PID:8068

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17828

Network

DNS

g.bing.com

Remote address:

8.8.8.8:53

Request

g.bing.com

IN A

Response

g.bing.com

IN CNAME

g-bing-com.ax-0001.ax-msedge.net

g-bing-com.ax-0001.ax-msedge.net

IN CNAME

ax-0001.ax-msedge.net

ax-0001.ax-msedge.net

IN A

150.171.27.10

ax-0001.ax-msedge.net

IN A

150.171.28.10
GET

https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ae6577b98cac49f1aba5316bd133da13&localId=w:E8C31A05-90CA-DE8F-A29D-2E3C02D092EA&deviceId=6966572651686081&anid=

Remote address:

150.171.27.10:443

Request

GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ae6577b98cac49f1aba5316bd133da13&localId=w:E8C31A05-90CA-DE8F-A29D-2E3C02D092EA&deviceId=6966572651686081&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)

Response

HTTP/2.0 204

cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=124CB14682B46D8605C5A45E83856CF8; domain=.bing.com; expires=Sat, 08-Nov-2025 01:25:50 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 6EBA088628BD4AC69FE4AA5CB9F06C31 Ref B: LON601060102060 Ref C: 2024-10-14T01:25:50Z
date: Mon, 14 Oct 2024 01:25:50 GMT
GET

https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=ae6577b98cac49f1aba5316bd133da13&localId=w:E8C31A05-90CA-DE8F-A29D-2E3C02D092EA&deviceId=6966572651686081&anid=

Remote address:

150.171.27.10:443

Request

GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=ae6577b98cac49f1aba5316bd133da13&localId=w:E8C31A05-90CA-DE8F-A29D-2E3C02D092EA&deviceId=6966572651686081&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=124CB14682B46D8605C5A45E83856CF8

Response

HTTP/2.0 204

cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=Koq-stYttNPqPf5diJ8fKTAj4QuHsnPCbpNOfZkKQw8; domain=.bing.com; expires=Sat, 08-Nov-2025 01:25:50 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: AFE111F2F4694D89A5CA28A18E37E3FB Ref B: LON601060102060 Ref C: 2024-10-14T01:25:50Z
date: Mon, 14 Oct 2024 01:25:50 GMT
GET

https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ae6577b98cac49f1aba5316bd133da13&localId=w:E8C31A05-90CA-DE8F-A29D-2E3C02D092EA&deviceId=6966572651686081&anid=

Remote address:

150.171.27.10:443

Request

GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ae6577b98cac49f1aba5316bd133da13&localId=w:E8C31A05-90CA-DE8F-A29D-2E3C02D092EA&deviceId=6966572651686081&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=124CB14682B46D8605C5A45E83856CF8; MSPTC=Koq-stYttNPqPf5diJ8fKTAj4QuHsnPCbpNOfZkKQw8

Response

HTTP/2.0 204

cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 7E458D98AE2C401E8F81DE73EB1DA0DB Ref B: LON601060102060 Ref C: 2024-10-14T01:25:51Z
date: Mon, 14 Oct 2024 01:25:50 GMT
DNS

172.210.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.210.232.199.in-addr.arpa

IN PTR

Response
DNS

64.159.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

64.159.190.20.in-addr.arpa

IN PTR

Response
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

53.210.109.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

53.210.109.20.in-addr.arpa

IN PTR

Response
DNS

198.187.3.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

198.187.3.20.in-addr.arpa

IN PTR

Response
DNS

98.117.19.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

98.117.19.2.in-addr.arpa

IN PTR

Response

98.117.19.2.in-addr.arpa

IN PTR

a2-19-117-98deploystaticakamaitechnologiescom
DNS

13.227.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

13.227.111.52.in-addr.arpa

IN PTR

Response
DNS

172.214.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.214.232.199.in-addr.arpa

IN PTR

Response

150.171.27.10:443

https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ae6577b98cac49f1aba5316bd133da13&localId=w:E8C31A05-90CA-DE8F-A29D-2E3C02D092EA&deviceId=6966572651686081&anid=

tls, http2

2.0kB
9.4kB
22
19

HTTP Request

GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ae6577b98cac49f1aba5316bd133da13&localId=w:E8C31A05-90CA-DE8F-A29D-2E3C02D092EA&deviceId=6966572651686081&anid=

HTTP Response

204

HTTP Request

GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=ae6577b98cac49f1aba5316bd133da13&localId=w:E8C31A05-90CA-DE8F-A29D-2E3C02D092EA&deviceId=6966572651686081&anid=

HTTP Response

204

HTTP Request

GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ae6577b98cac49f1aba5316bd133da13&localId=w:E8C31A05-90CA-DE8F-A29D-2E3C02D092EA&deviceId=6966572651686081&anid=

HTTP Response

204

8.8.8.8:53

g.bing.com

dns

56 B
148 B
1
1

DNS Request

g.bing.com

DNS Response

150.171.27.10

150.171.28.10
8.8.8.8:53

172.210.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.210.232.199.in-addr.arpa
8.8.8.8:53

64.159.190.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

64.159.190.20.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

53.210.109.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

53.210.109.20.in-addr.arpa
8.8.8.8:53

198.187.3.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

198.187.3.20.in-addr.arpa
8.8.8.8:53

98.117.19.2.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

98.117.19.2.in-addr.arpa
8.8.8.8:53

13.227.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

13.227.111.52.in-addr.arpa
8.8.8.8:53

172.214.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.214.232.199.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10070.exe

Filesize
468KB

MD5
4deb9b683e141b66a64e965e2ea0f710

SHA1
31c0a0f849bce78eebd095b5d000bff43e451c49

SHA256
d734f99d6ef401c414af26cf50d3a1e46a352db2bcaa51234efb95378a167626

SHA512
0f10b08d4f7619110b99c85b87ddf6901c113e5476b05b1a2179ab1473a0f83abaa7577d2eb510c8e80f8741d475db1cb4770ddb681fdeca81bbc2f664e0ab75

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-10712.exe

Filesize
468KB

MD5
661a5f2d398b11147a8a5f48530d6b41

SHA1
055ee5710f03516fc1fcf5ebfcf94e2176bb728e

SHA256
fd609f6adc0d07dd8c70600217023120999f06a78137a9835fc1b98d4caff3d5

SHA512
68a3011874f1c6ec6e8132c74fa2b1b78f396cdac96bc2842fb2dd6dd79170681b5c9d47d8a4219b2b190074d944b8ce1ed55fb3cdb71a937d5bc3f149661207

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11487.exe

Filesize
468KB

MD5
92e7369de32b02dc5fd46b4e7e6891f6

SHA1
153d40a98a23170dc888da946674108d6a5b4538

SHA256
54c20039bd5e750b6a2a2bf4433688b588b521ed2b77c1bdc8a93217955e0159

SHA512
28b5102b33b6177d7a9589d4ae2707daa6500844c9106700b3ea8caa60c2aa3721bb6d24ba24c7c637938287dc5e65b9ce96794137e59150145d7904ab0cafeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12870.exe

Filesize
468KB

MD5
3ebd125f87451d854f7767ff1f2084f7

SHA1
1f3344a3e9f03f8fde6930626af58212a153733b

SHA256
52c8abec7d61fa6d4e43393d495e07c87f5aaf0dff009d9e53eb025880a7d4fd

SHA512
66784b5bcb2b6c96f9730791ad0d9a4a1267fc2c1bae876c942c843dd5e545b3a0ca8fe4f180bc5b2b3e3ebe3994c840ab0bba0b9717a635e9904c03839902eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14499.exe

Filesize
468KB

MD5
669abb570fea365f1207954406828ea0

SHA1
5c1ced33ef5a02abe7daf62369bc3eb139816f23

SHA256
b737bfb9fa5ccfa582223781bda79794431f31a3bc6eff2d7fc455f0ef067144

SHA512
4fe7e7a5fbf5b34b3c4f9a14cb333dc6c7c08b66f9a0c667071d7006ab9c13e87c6c2894ee8790f24c5093ad30b9637c7d7d9e183e0cc1e208ae30306d54bc95

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15189.exe

Filesize
468KB

MD5
17c441bdfc8b4e40149893ea50c4c095

SHA1
b7396dd6f64dc193939e5bff3a02ac02c27f901f

SHA256
5e483ad1126b0386a442b9abd75df363427fff9dbcc4e3f55d6420121ed60c5b

SHA512
421cceb9421e2aacaf7bac8c46823779963ab66f4dcfb09c49d39c4c14acd85d1b22d00d458ce68a8e1fc4729ffe934cb014d488f7e104830832b5180549a594

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15416.exe

Filesize
468KB

MD5
4d6d513ba069e3f18df09c83e26fef50

SHA1
ed1d3040fd426f1a1a877b63c41e8c46d9289cfa

SHA256
cf9ebc635fddcf2c1b1ec2a6636f2097f30eea79147ed7536062a4e53bc68fe9

SHA512
1b2f7b86170d147a02c5102ed10fd1e02106331c03574a9761c68273472e98d57fcb70856b0ab4d588a9d6d7076a327216b0227495ef38eda83fc2c0550da989

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16368.exe

Filesize
468KB

MD5
ba738ede9aeda6edd3d1da4d83c00f24

SHA1
4f67359c7cb29eabb9962a307caa5de242392e9a

SHA256
97049d945773fef26c187152c0051d6c63c47835c278577c497f2f65c44cd2af

SHA512
6a2732d7ee7606529ca41a56f4113755e107d07f7af84bb1b0772536de80c282af4b013979bd8a6e236ec9ea012e625ad5628bfe79fcbf957f223a6ee0831d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21039.exe

Filesize
468KB

MD5
e981f26657e7bb3c8ed7ee0d155a3ca5

SHA1
56dc3c3dbd38f3155e0056b55c4adba38217a1e0

SHA256
cfe7b5e230c345c2f3b476f208d43d4dbfddff4c5db220f6173a9d4584291fc5

SHA512
8afe7f742a6bc280f93bb5e50eb93bcd483a086ff65a9da460b679d6d6b1b318cf8b06bdcf408b3e36c6a175aef34502c93a2b10e63412097fb1c44091cf562b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21305.exe

Filesize
468KB

MD5
e23e75df80be0ad327d1134f889007c1

SHA1
77995c11190566094911e62358586ea64637a9f6

SHA256
252bb958adb3ad8063dfea8e8ef09f66d4cb80bb54b049f81d4a234428afa3ce

SHA512
63d308181f0e60543a102a71a3e15101c1064f70a6fcd874ff0dd9c18974610382a2ad797aad86a50ecf51dc99c9559369adaedc380b4bb2fbb0f4d1e28cd669

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22503.exe

Filesize
468KB

MD5
1e3f995acea95dab795728b122c16f15

SHA1
6efccf59d39d2442accaa593f8e18dd2e9e8798f

SHA256
286716b9eea2b71ca995a7bdd66cdf8d1bc10440b25f41de96ad6aa49080bbec

SHA512
ac19ac8c8ffc78bc4cb46b5ed0d62b4874a9bd65ed0bfd66eeb059ec0b07548783e51cf15aded500301dd53f120d38cbfd69c18b910990456b57f04fe327f0c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29343.exe

Filesize
468KB

MD5
7d2b9aac94458e5e0ae04b8b216002f3

SHA1
b0a95033f2a48aae32b36cbc32fd087cc020638d

SHA256
4d5bcd77a063951a81b77c7a858a3dd97977da1a322c0cb6f7085103d7508edb

SHA512
ed496c3e0cb57a00336a194e4d985d0c2c0302c6c32ea00a31f5e362ccefd42f257755ffae391e1cf508983c1590cb36f798c9a9c657a7b0965e00f294a74959

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29942.exe

Filesize
468KB

MD5
12380213f898b7684ee02bb2acb5c03e

SHA1
2d92ce936422e68f6fa3233b23e1c75a379ecc1a

SHA256
a08836edf90b7d2503624ed686864e5c602cc21f97d15dfcbabb60398f912529

SHA512
29084385defb62428037cb3c97ba685a1298db8f12880439397bd5c69603babfef832876c770168a55d5368b21753aa361c4f8349a3248dc773c70c7ba87c992

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3032.exe

Filesize
468KB

MD5
072f3ee5e472cb5ec1bd2e6ee577c825

SHA1
6afd42f4fbe11c3479c3f79d5fc0fd971673c1e3

SHA256
e7038557133015c084eaad85a23fa29186de0251116c6fe534d1ceae8473a7af

SHA512
751c54a1339b179cba87e5461beffce3e7cdf30204c5f067ed5df7eebcfa74005690997d79c2a49b5bc5ea614b44554e767253a7ef71a96b872043d5f30d5997

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31545.exe

Filesize
468KB

MD5
6e4f44f6d62aa8779f94eeec550f09a3

SHA1
7934b871a731e7916f67e7ace74f94008cf1c5b4

SHA256
253adde3f1fa95651c8c726f04144f0b91551b363497cee6ef457ee32c9593b8

SHA512
c88d12691cc284be0321397ca7104dcbd41ba7a1e42cdc38622868eded160ae4e9dc9abfed4a58799aee14709de99244eb3ca292f8538f4b69ab046cff242749

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31615.exe

Filesize
468KB

MD5
60fc099a8c10c75a7b6c7b136cbf3734

SHA1
1a56e834f2448db40d6e91adfd22591d48c7112a

SHA256
d80b5abd8816a6841873ece00aa021b04b03d9ff669c63c024a1bc1240e14aaf

SHA512
6e3a2ec240711c6864bb41d39bad9cee3387140493350135b3cea6637bcc71f9d2b3d7e5d87786488b35b0eff985464aa475b26993c928a035e0a96f6654993c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33820.exe

Filesize
468KB

MD5
173a54d24ef24af66b1a2af1287de787

SHA1
b8fa1441b8992c720a83a6ee2f9c6a591c227e6c

SHA256
8a2949b7d0263ab798c6bfa497d7468dd2bd0dc92c188781ca41bbcad9fe6f60

SHA512
1635e272566610fde1f817e25d340f588df37b02c481beab9e2f7260dc5b6b52e690229d2b66a3aa23d156963048dce4a156801eec2d7f30968680c1b16b937d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35312.exe

Filesize
468KB

MD5
6baa8a1c14cd11af3244b53ae0790554

SHA1
41446fafac6ed95afda114e658c60320d5799f67

SHA256
8bdbaa42525718df0304af048e6f84c6e852e759359a3ed63acff26d561c33e6

SHA512
54177b24df7daddd8feb25f8dd1632604444508ecfb3cd56c6cd75db6c777ee056f7624cdcc78d4fdd39b964a85921808a225d31d533be07fab7e15b468b012e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35705.exe

Filesize
468KB

MD5
3e6ffb0f91f70cf18c18db1b1c39bb0e

SHA1
13074c4f726d5fca9a49820a703b1ac1cd74c7f7

SHA256
9b8f6ad282039fe9cd5d1a2c61237d7294c55785fd2dface72cfd1edba2563b3

SHA512
a3e7aded72f5478d87b2226d8e2a8db262ceb912e77ba1c8d8aa4f098766c72eb84e33f9ddafb2fa9acbd394e0d2dbdca60e12b9aff4ca82c0c9e852816f9629

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35897.exe

Filesize
468KB

MD5
29aab613c5471c43e704f7ee1fa93522

SHA1
8e6414c44d6617d7694d3cc35148341bd93c0349

SHA256
80d2fcdbbda7ae78d5323bd535d4ac36342840f3c2d36852da660c394d26f13e

SHA512
1def1d10686af1cf464e65c9bde532cc735f07e38439e2f3b2dab54ce9ecd2e245a3c1297fd525e218764aca5d765013907580905ba62590f25e0ab8c36b7770

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40132.exe

Filesize
468KB

MD5
5f30ed76c1bd220ff70ec3b8e8e3ee9d

SHA1
4465e06d0ce902ab591cd768c0479e24121e7b2e

SHA256
9dc180df1de5a310c178a88ab3f13b3ebe11873deb9ef8324fe4b51e46a3fc26

SHA512
9fe82ec86948d4a3046b1487a3a0617cece98311f1bf48224caf8cc19297a55b631dcc9550d7839fdd99e6ef4170ff49e0e2e39164b11e8058010f82e69d7188

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44007.exe

Filesize
468KB

MD5
cb0f29d20e72001776ff624169d9d5f8

SHA1
dd8b4e1249a5aa5da777c357d9bfea374c1f022d

SHA256
91f760c5354f103432032409d045ad9952855152864f78dd212c219c57bd8d7f

SHA512
043ec2cdd3f7791f9a55a56e813985031ae5993803e2dbc8cdd6ab502016bbacb65f03e0393149b7059279e3e1b5fdae3e4fc5003ed3a89bfb1cf75ff7c13014

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49239.exe

Filesize
468KB

MD5
b8721f803193f4f3d25a19b2473e76eb

SHA1
010df5e37a28d477f210b6bb8653219f82dee1e4

SHA256
3642e22f0da22c5e6470c6f368d9e3e97b549eb3abc0306f10d1769e7a461453

SHA512
083fda8237a0e5ec5aafe04796e756f6f6c09503a31cda7615dd92d31d01f356b96ca20d793a5a6c0e35312de03de102885cb57d17bd25f854120c3b6b493a75

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49904.exe

Filesize
468KB

MD5
81ea7d503dd2b090485c40e8e0b598df

SHA1
ded13cb70a3c5a865efc6caf3e3b637b60ed77f5

SHA256
18d06c1d0f52a3fc7137f8f3358c9b357964ef679cbc0b45cf72596638e59246

SHA512
3b4f4a6e44f8b334758c733ff0286a8c630b78761f830166777f17e82f5dcab5538dffdadf94c4500c2f0c9680ba13735d3716a9437dd9425e8ab48024d60919

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49945.exe

Filesize
468KB

MD5
2ab5614ae34ff93d9858d846590cde9b

SHA1
b322058705a7a7be032731938619ad0df0dc9ff1

SHA256
307c95c0d66383935080f3eb6163a252f3634a62aebd9aee17a46fff3ea3f211

SHA512
5ce200f4930ca839dec3d8a396c97e27f649376dff8ffd3106b01138702222aa9a57d032b4a3e7755e02cee7cd29d70d1f29d952bddcea6c88cf8f04b7972d16

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50137.exe

Filesize
468KB

MD5
48d83646817fb8d85b419f6c4f8af1ed

SHA1
2e90dab55a81214992fcf42573d4f5c616bc9210

SHA256
ec295d2d99c0f04f76ae8ddfc327826020f08f52edde3f8335f5aa866f894feb

SHA512
af12ea689d5a0312a36607e82aab227a36b7fcfc25ab6fa21dc82079cd9215a6769de4f762dd2e5c77fe5b046e1293ebcb73b10d271a390d28fd64f2ed5d1939

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51481.exe

Filesize
468KB

MD5
7f526eabc6ed5c021d0f46a8ce651810

SHA1
3d8b90c5021226338517186a424bf01d9d3f1c85

SHA256
c0b68566bd253eae2e34dec010f3b1365281fab9ca24eaa724c5a691858e64a6

SHA512
3655c4fc5a6c4a523ce45072fa20a992cb232769650885caf7cd91f3538dbc95a9dda630caba65fc40d8667d3d901e9e3efa5d2c985b148c23e0f32ecf71ea99

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57575.exe

Filesize
468KB

MD5
6e95f480d1a64b6279444671c1c547ae

SHA1
82be66aa875295c1bf9839bf7f78015c2e6b6b69

SHA256
5c838d039f56e625c94cbb95e83a6f1a1e1361c05fb62d007ad241e5c160e00a

SHA512
68053e6e546caf685736a5670f97d2c23844602fc2e9e818c9b3f5dc07a379f57b96ff0b6d7d48522c3600ce82c9a2e39ec384fe0045f6b424792281e9c294dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64217.exe

Filesize
468KB

MD5
36449406e35e903b4fd0e470a66eb646

SHA1
b346359f82d5da8fbb67d2693d298f64a9f84676

SHA256
5525a0ff9f47a1ec6f50ad2b8f359c89c4663e45064f31ab161c11b8cd00e355

SHA512
fd719e0abd122ca6f7c8ec19b8a4af85d83e98e4b3cbe66e6d9c397938827355d77b36f40872396a959d1b120c618fb9a02759bcf5d3cdb130200b518fdd5bfb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64672.exe

Filesize
468KB

MD5
d42efef611f1c4270973bc9be634a12d

SHA1
b5134846034e4a9d614c65c3f2dc625d38d2d016

SHA256
2adbe40868973be65b88925f2a14fde0e8541f2b7a6ff5e86dd050c4114b90d5

SHA512
58215ed4570357f3070aa582442fc32133e345bf903f25044849668ce8506ab39501da98730e9a84006fb75da8a4d152f6cc429c77ab637e1036ee66d7eaef9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7407.exe

Filesize
468KB

MD5
ae88a1b1431bcda365ab7170fa377364

SHA1
3e6721b3524ac53203f486e75a2c5e7cff27b3af

SHA256
9489fae1a1e7ada7637de3d6cba5a031a39e80c77f1b3230dca74e6d63f817f9

SHA512
a19850b5857fa2d1cacaa2bce8f2c427a1e9d8ae62970ea5ed4ecf4e7d83e959dd0191672e89028a563bf33e9c40c317c0d304253816ff55136522838fbe7ebe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8636.exe

Filesize
468KB

MD5
a906b6f002024f8f84a45c31f5b50688

SHA1
a10b79d3fc0a051062b9987d9e9af5b24ac3940f

SHA256
5c0031982b6b218188b5cfdc63f231ab71ba47ab8f13a23052d9061b18d9c401

SHA512
f6d6d18125c5f0991195d4d3ac850ff14f549aa8a0bec62ef31dfe273f858899b02c2b4390dd7fbbf1259b8d4e3d7536a5872219871b32e9da9953fe5f6bf2f1

Download Submit
memory/20892-6635-0x00007FFACE5A0000-0x00007FFACE5F9000-memory.dmp

Filesize
356KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.