359f3192ab4c3a160fe69ffe4c73654dbc0956df3fc15b4132660c9b5af17cc6

Analysis

max time kernel
119s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2024 02:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

359f3192ab4c3a160fe69ffe4c73654dbc0956df3fc15b4132660c9b5af17cc6N.exe
Size

184KB
MD5

05c0d7459044fa78e4d23bd90acbdf80
SHA1

2a45ac554d6ab14304ae81cfcbf6aa4b9958e080
SHA256

359f3192ab4c3a160fe69ffe4c73654dbc0956df3fc15b4132660c9b5af17cc6
SHA512

498f7e2c648910c2da16c24bc929f2963fc04667f518f73f445ff4045cafb8522e53b8c13a86b7b7e0c87802f4cdfa80d1d65d619f01faceb640945e4c4d8e8b
SSDEEP

3072:qsmB8Co2JjH9ZIz9rjPqwCtIlvnqXvG0q:qs2oyXIzlq/tIlPqXvG0

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2204	Unicorn-4067.exe
872	Unicorn-53076.exe
4164	Unicorn-49355.exe
2056	Unicorn-3398.exe
3380	Unicorn-17274.exe
2348	Unicorn-52215.exe
1160	Unicorn-46085.exe
3156	Unicorn-16500.exe
4636	Unicorn-22631.exe
4552	Unicorn-39844.exe
2152	Unicorn-39844.exe
4520	Unicorn-39844.exe
3324	Unicorn-6906.exe
5080	Unicorn-52843.exe
3576	Unicorn-63506.exe
5000	Unicorn-38500.exe
1536	Unicorn-53694.exe
3524	Unicorn-53575.exe
1880	Unicorn-37924.exe
3092	Unicorn-36855.exe
632	Unicorn-50923.exe
3912	Unicorn-31601.exe
2920	Unicorn-45138.exe
2224	Unicorn-34202.exe
3832	Unicorn-39406.exe
3204	Unicorn-54600.exe
4416	Unicorn-57662.exe
4692	Unicorn-21076.exe
5068	Unicorn-40942.exe
4220	Unicorn-21076.exe
4396	Unicorn-63615.exe
1780	Unicorn-17214.exe
3424	Unicorn-57745.exe
4684	Unicorn-37687.exe
3612	Unicorn-57553.exe
3540	Unicorn-57361.exe
1092	Unicorn-57361.exe
1804	Unicorn-44782.exe
5092	Unicorn-24039.exe
1128	Unicorn-43640.exe
4372	Unicorn-37775.exe
3952	Unicorn-37775.exe
2940	Unicorn-18439.exe
1032	Unicorn-56520.exe
2912	Unicorn-65093.exe
3956	Unicorn-19422.exe
2888	Unicorn-43356.exe
696	Unicorn-52286.exe
1360	Unicorn-31739.exe
3076	Unicorn-20007.exe
4800	Unicorn-44222.exe
820	Unicorn-6759.exe
1756	Unicorn-26241.exe
4728	Unicorn-58721.exe
4516	Unicorn-58721.exe
2480	Unicorn-58721.exe
4228	Unicorn-58721.exe
4944	Unicorn-20603.exe
3468	Unicorn-23588.exe
2060	Unicorn-58264.exe
1652	Unicorn-33063.exe
3972	Unicorn-20603.exe
3420	Unicorn-22135.exe
3888	Unicorn-44497.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
4796	2224	WerFault.exe	114
6216	5124	WerFault.exe	185
18412	9356	WerFault.exe	924
19384	9356	Process not Found	924
8980	9368	Process not Found	922
6920	9368	WerFault.exe	922

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41823.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31617.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59011.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53146.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-486.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44648.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37438.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7136.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20619.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-95.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52239.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49103.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58405.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52511.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58376.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61896.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59086.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49455.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42792.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22718.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53146.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9151.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53146.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47969.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50901.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32734.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43964.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33810.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61896.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22718.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19422.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59233.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10368.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18071.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60559.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7742.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52239.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51455.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26382.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50865.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33303.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4423.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35937.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30437.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-102.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33639.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59674.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58104.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47176.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34732.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	18104	dwm.exe
Token: SeChangeNotifyPrivilege	18104	dwm.exe
Token: 33	18104	dwm.exe
Token: SeIncBasePriorityPrivilege	18104	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3168	359f3192ab4c3a160fe69ffe4c73654dbc0956df3fc15b4132660c9b5af17cc6N.exe
2204	Unicorn-4067.exe
872	Unicorn-53076.exe
4164	Unicorn-49355.exe
3380	Unicorn-17274.exe
2348	Unicorn-52215.exe
2056	Unicorn-3398.exe
1160	Unicorn-46085.exe
3156	Unicorn-16500.exe
4636	Unicorn-22631.exe
4552	Unicorn-39844.exe
4520	Unicorn-39844.exe
3324	Unicorn-6906.exe
2152	Unicorn-39844.exe
5080	Unicorn-52843.exe
3576	Unicorn-63506.exe
5000	Unicorn-38500.exe
1536	Unicorn-53694.exe
3524	Unicorn-53575.exe
1880	Unicorn-37924.exe
632	Unicorn-50923.exe
3912	Unicorn-31601.exe
2224	Unicorn-34202.exe
2920	Unicorn-45138.exe
3092	Unicorn-36855.exe
3832	Unicorn-39406.exe
3204	Unicorn-54600.exe
4416	Unicorn-57662.exe
4692	Unicorn-21076.exe
4220	Unicorn-21076.exe
5068	Unicorn-40942.exe
4396	Unicorn-63615.exe
1780	Unicorn-17214.exe
3424	Unicorn-57745.exe
4684	Unicorn-37687.exe
3612	Unicorn-57553.exe
1092	Unicorn-57361.exe
3540	Unicorn-57361.exe
1804	Unicorn-44782.exe
1032	Unicorn-56520.exe
2940	Unicorn-18439.exe
1128	Unicorn-43640.exe
5092	Unicorn-24039.exe
4372	Unicorn-37775.exe
3952	Unicorn-37775.exe
2912	Unicorn-65093.exe
3956	Unicorn-19422.exe
696	Unicorn-52286.exe
2888	Unicorn-43356.exe
1360	Unicorn-31739.exe
3076	Unicorn-20007.exe
4800	Unicorn-44222.exe
820	Unicorn-6759.exe
2060	Unicorn-58264.exe
1756	Unicorn-26241.exe
4516	Unicorn-58721.exe
2480	Unicorn-58721.exe
4228	Unicorn-58721.exe
4728	Unicorn-58721.exe
3972	Unicorn-20603.exe
3468	Unicorn-23588.exe
1652	Unicorn-33063.exe
4944	Unicorn-20603.exe
3420	Unicorn-22135.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 2204	3168	359f3192ab4c3a160fe69ffe4c73654dbc0956df3fc15b4132660c9b5af17cc6N.exe	84
PID 3168 wrote to memory of 2204	3168	359f3192ab4c3a160fe69ffe4c73654dbc0956df3fc15b4132660c9b5af17cc6N.exe	84
PID 3168 wrote to memory of 2204	3168	359f3192ab4c3a160fe69ffe4c73654dbc0956df3fc15b4132660c9b5af17cc6N.exe	84
PID 2204 wrote to memory of 872	2204	Unicorn-4067.exe	85
PID 2204 wrote to memory of 872	2204	Unicorn-4067.exe	85
PID 2204 wrote to memory of 872	2204	Unicorn-4067.exe	85
PID 3168 wrote to memory of 4164	3168	359f3192ab4c3a160fe69ffe4c73654dbc0956df3fc15b4132660c9b5af17cc6N.exe	86
PID 3168 wrote to memory of 4164	3168	359f3192ab4c3a160fe69ffe4c73654dbc0956df3fc15b4132660c9b5af17cc6N.exe	86
PID 3168 wrote to memory of 4164	3168	359f3192ab4c3a160fe69ffe4c73654dbc0956df3fc15b4132660c9b5af17cc6N.exe	86
PID 872 wrote to memory of 2056	872	Unicorn-53076.exe	91
PID 872 wrote to memory of 2056	872	Unicorn-53076.exe	91
PID 872 wrote to memory of 2056	872	Unicorn-53076.exe	91
PID 2204 wrote to memory of 3380	2204	Unicorn-4067.exe	92
PID 2204 wrote to memory of 3380	2204	Unicorn-4067.exe	92
PID 2204 wrote to memory of 3380	2204	Unicorn-4067.exe	92
PID 4164 wrote to memory of 2348	4164	Unicorn-49355.exe	93
PID 4164 wrote to memory of 2348	4164	Unicorn-49355.exe	93
PID 4164 wrote to memory of 2348	4164	Unicorn-49355.exe	93
PID 3168 wrote to memory of 1160	3168	359f3192ab4c3a160fe69ffe4c73654dbc0956df3fc15b4132660c9b5af17cc6N.exe	94
PID 3168 wrote to memory of 1160	3168	359f3192ab4c3a160fe69ffe4c73654dbc0956df3fc15b4132660c9b5af17cc6N.exe	94
PID 3168 wrote to memory of 1160	3168	359f3192ab4c3a160fe69ffe4c73654dbc0956df3fc15b4132660c9b5af17cc6N.exe	94
PID 2204 wrote to memory of 3156	2204	Unicorn-4067.exe	96
PID 2204 wrote to memory of 3156	2204	Unicorn-4067.exe	96
PID 2204 wrote to memory of 3156	2204	Unicorn-4067.exe	96
PID 3380 wrote to memory of 4636	3380	Unicorn-17274.exe	97
PID 3380 wrote to memory of 4636	3380	Unicorn-17274.exe	97
PID 3380 wrote to memory of 4636	3380	Unicorn-17274.exe	97
PID 1160 wrote to memory of 4552	1160	Unicorn-46085.exe	98
PID 1160 wrote to memory of 4552	1160	Unicorn-46085.exe	98
PID 1160 wrote to memory of 4552	1160	Unicorn-46085.exe	98
PID 2348 wrote to memory of 2152	2348	Unicorn-52215.exe	99
PID 2348 wrote to memory of 2152	2348	Unicorn-52215.exe	99
PID 2348 wrote to memory of 2152	2348	Unicorn-52215.exe	99
PID 2056 wrote to memory of 4520	2056	Unicorn-3398.exe	100
PID 2056 wrote to memory of 4520	2056	Unicorn-3398.exe	100
PID 2056 wrote to memory of 4520	2056	Unicorn-3398.exe	100
PID 3168 wrote to memory of 3324	3168	359f3192ab4c3a160fe69ffe4c73654dbc0956df3fc15b4132660c9b5af17cc6N.exe	101
PID 3168 wrote to memory of 3324	3168	359f3192ab4c3a160fe69ffe4c73654dbc0956df3fc15b4132660c9b5af17cc6N.exe	101
PID 3168 wrote to memory of 3324	3168	359f3192ab4c3a160fe69ffe4c73654dbc0956df3fc15b4132660c9b5af17cc6N.exe	101
PID 872 wrote to memory of 5080	872	Unicorn-53076.exe	102
PID 872 wrote to memory of 5080	872	Unicorn-53076.exe	102
PID 872 wrote to memory of 5080	872	Unicorn-53076.exe	102
PID 4164 wrote to memory of 3576	4164	Unicorn-49355.exe	105
PID 4164 wrote to memory of 3576	4164	Unicorn-49355.exe	105
PID 4164 wrote to memory of 3576	4164	Unicorn-49355.exe	105
PID 3156 wrote to memory of 5000	3156	Unicorn-16500.exe	106
PID 3156 wrote to memory of 5000	3156	Unicorn-16500.exe	106
PID 3156 wrote to memory of 5000	3156	Unicorn-16500.exe	106
PID 2204 wrote to memory of 1536	2204	Unicorn-4067.exe	107
PID 2204 wrote to memory of 1536	2204	Unicorn-4067.exe	107
PID 2204 wrote to memory of 1536	2204	Unicorn-4067.exe	107
PID 4636 wrote to memory of 3524	4636	Unicorn-22631.exe	108
PID 4636 wrote to memory of 3524	4636	Unicorn-22631.exe	108
PID 4636 wrote to memory of 3524	4636	Unicorn-22631.exe	108
PID 2152 wrote to memory of 1880	2152	Unicorn-39844.exe	109
PID 2152 wrote to memory of 1880	2152	Unicorn-39844.exe	109
PID 2152 wrote to memory of 1880	2152	Unicorn-39844.exe	109
PID 3324 wrote to memory of 3092	3324	Unicorn-6906.exe	110
PID 3324 wrote to memory of 3092	3324	Unicorn-6906.exe	110
PID 3324 wrote to memory of 3092	3324	Unicorn-6906.exe	110
PID 3380 wrote to memory of 632	3380	Unicorn-17274.exe	111
PID 3380 wrote to memory of 632	3380	Unicorn-17274.exe	111
PID 3380 wrote to memory of 632	3380	Unicorn-17274.exe	111
PID 872 wrote to memory of 3912	872	Unicorn-53076.exe	112

C:\Users\Admin\AppData\Local\Temp\359f3192ab4c3a160fe69ffe4c73654dbc0956df3fc15b4132660c9b5af17cc6N.exe
"C:\Users\Admin\AppData\Local\Temp\359f3192ab4c3a160fe69ffe4c73654dbc0956df3fc15b4132660c9b5af17cc6N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4067.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4067.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53076.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53076.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3398.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39844.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21076.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58721.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48545.exe
        8⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26398.exe
        9⤵
        
        PID:8208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7140.exe
        9⤵
        
        PID:11268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51455.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:15476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49487.exe
        9⤵
        
        PID:18624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18807.exe
        8⤵
        
        PID:8604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23521.exe
        9⤵
        
        PID:9008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22718.exe
        9⤵
        
        PID:15124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10402.exe
        9⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61295.exe
        8⤵
        
        PID:10860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51432.exe
        8⤵
        
        PID:14568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44638.exe
        8⤵
        
        PID:18352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62312.exe
        7⤵
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45022.exe
        8⤵
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64008.exe
        8⤵
        
        PID:10264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1390.exe
        8⤵
        
        PID:13892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46792.exe
        8⤵
        
        PID:18336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37273.exe
        8⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58383.exe
        7⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19518.exe
        8⤵
        
        PID:12816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40039.exe
        8⤵
        
        PID:16772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59674.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57564.exe
        7⤵
        
        PID:10960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46823.exe
        7⤵
        
        PID:14528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21467.exe
        7⤵
        
        PID:17800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20603.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58581.exe
        7⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49057.exe
        8⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53077.exe
        8⤵
        
        PID:11320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54255.exe
        8⤵
        
        PID:15216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        8⤵
        
        PID:18744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24395.exe
        7⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34520.exe
        7⤵
        
        PID:12772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50975.exe
        7⤵
        
        PID:16728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
        7⤵
        
        PID:4720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16759.exe
        6⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23223.exe
        7⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1275.exe
        7⤵
        
        PID:11300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13607.exe
        7⤵
        
        PID:15392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-486.exe
        7⤵
        
        PID:18684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7918.exe
        6⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50414.exe
        7⤵
        
        PID:17104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55088.exe
        7⤵
        
        PID:18592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44759.exe
        6⤵
        
        PID:10872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36894.exe
        6⤵
        
        PID:14544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39303.exe
        6⤵
        
        PID:18304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17214.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58721.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26981.exe
        7⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63135.exe
        7⤵
        
        PID:11284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53944.exe
        7⤵
        
        PID:15572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50876.exe
        7⤵
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29255.exe
        6⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54079.exe
        7⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1764.exe
        7⤵
        
        PID:12260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49439.exe
        7⤵
        
        PID:876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
        7⤵
        
        PID:19188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25326.exe
        6⤵
        
        PID:7452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7376.exe
        7⤵
        
        PID:8492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22718.exe
        7⤵
        
        PID:14832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-102.exe
        7⤵
        
        PID:19448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19223.exe
        6⤵
        
        PID:10468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49711.exe
        6⤵
        
        PID:14452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1016.exe
        6⤵
        
        PID:18724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58264.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32702.exe
        6⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36833.exe
        7⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10368.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4679.exe
        8⤵
        
        PID:16436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53146.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54392.exe
        7⤵
        
        PID:9656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
        7⤵
        
        PID:14216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56117.exe
        7⤵
        
        PID:17704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41959.exe
        6⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7376.exe
        7⤵
        
        PID:8668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30437.exe
        7⤵
        
        PID:15632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50346.exe
        7⤵
        
        PID:19156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6238.exe
        6⤵
        
        PID:10092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51941.exe
        6⤵
        
        PID:14012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38511.exe
        6⤵
        
        PID:18204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34732.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40191.exe
        5⤵
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64897.exe
        6⤵
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3152.exe
        7⤵
        
        PID:10616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38775.exe
        7⤵
        
        PID:14428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        7⤵
        
        PID:18904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59487.exe
        6⤵
        
        PID:10840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22824.exe
        6⤵
        
        PID:14612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54487.exe
        6⤵
        
        PID:1968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15895.exe
        5⤵
        
        PID:7212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33457.exe
        6⤵
        
        PID:13420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53704.exe
        6⤵
        
        PID:17900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8016.exe
        5⤵
        
        PID:11164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30454.exe
        5⤵
        
        PID:15464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39687.exe
        5⤵
        
        PID:18756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52843.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22244.exe
        5⤵
        
        PID:4940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
        6⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64513.exe
        7⤵
        
        PID:7376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65160.exe
        7⤵
        
        PID:10484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52511.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-486.exe
        7⤵
        
        PID:18956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21495.exe
        6⤵
        
        PID:7316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27198.exe
        6⤵
        
        PID:10340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36856.exe
        6⤵
        
        PID:13532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47068.exe
        6⤵
        
        PID:6320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63647.exe
        5⤵
        
        PID:6840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7376.exe
        6⤵
        
        PID:9520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22718.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39574.exe
        6⤵
        
        PID:18364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51799.exe
        6⤵
        
        PID:4328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51480.exe
        5⤵
        
        PID:9724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56193.exe
        5⤵
        
        PID:14252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42870.exe
        5⤵
        
        PID:17488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26842.exe
        5⤵
        
        PID:7620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31601.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57361.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61409.exe
        6⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21111.exe
        7⤵
        
        PID:8644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15662.exe
        7⤵
        
        PID:11060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49431.exe
        7⤵
        
        PID:14028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50876.exe
        7⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42431.exe
        6⤵
        
        PID:7684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6343.exe
        6⤵
        
        PID:11172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50671.exe
        6⤵
        
        PID:14760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-632.exe
        6⤵
        
        PID:18240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60568.exe
        5⤵
        
        PID:3400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56241.exe
        6⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54079.exe
        7⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55180.exe
        7⤵
        
        PID:12748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60392.exe
        7⤵
        
        PID:16504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49641.exe
        7⤵
        
        PID:1264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13319.exe
        6⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4224.exe
        7⤵
        
        PID:13052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4782.exe
        7⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
        7⤵
        
        PID:18844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64479.exe
        6⤵
        
        PID:10808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11095.exe
        6⤵
        
        PID:14576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49103.exe
        6⤵
        
        PID:18224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12830.exe
        5⤵
        
        PID:6584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53089.exe
        6⤵
        
        PID:8724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39319.exe
        6⤵
        
        PID:11800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34750.exe
        6⤵
        
        PID:16520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
        6⤵
        
        PID:18892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36504.exe
        5⤵
        
        PID:8808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34126.exe
        5⤵
        
        PID:13264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39831.exe
        5⤵
        
        PID:17332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1016.exe
        5⤵
        
        PID:18916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43640.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45073.exe
        5⤵
        
        PID:1312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16967.exe
        6⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25137.exe
        7⤵
        
        PID:17840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2590.exe
        6⤵
        
        PID:9648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64328.exe
        6⤵
        
        PID:14240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63871.exe
        6⤵
        
        PID:17456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49455.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1152.exe
        6⤵
        
        PID:12364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38503.exe
        6⤵
        
        PID:15672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7510.exe
        6⤵
        
        PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22296.exe
        5⤵
        
        PID:11124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4743.exe
        5⤵
        
        PID:15616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50876.exe
        5⤵
        
        PID:404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5966.exe
      4⤵
      PID:1692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33303.exe
        5⤵
        
        PID:6804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7376.exe
        6⤵
        
        PID:8524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28775.exe
        6⤵
        
        PID:14164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2862.exe
        6⤵
        
        PID:17716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59728.exe
        6⤵
        
        PID:18552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62005.exe
        5⤵
        
        PID:10304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39335.exe
        5⤵
        
        PID:15824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43964.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8871.exe
      4⤵
      PID:6156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34641.exe
        5⤵
        
        PID:8340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3108.exe
        5⤵
        
        PID:11700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26382.exe
        5⤵
        
        PID:16160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11071.exe
        5⤵
        
        PID:3088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6832.exe
      4⤵
      PID:8504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4854.exe
      4⤵
      PID:12708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24639.exe
      4⤵
      PID:16672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45807.exe
      4⤵
      PID:2580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17274.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17274.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22631.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53575.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57745.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21559.exe
        7⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26398.exe
        8⤵
        
        PID:8216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8173.exe
        9⤵
        
        PID:12060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2375.exe
        9⤵
        
        PID:16280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53146.exe
        9⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5879.exe
        8⤵
        
        PID:11456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41180.exe
        8⤵
        
        PID:16040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
        8⤵
        
        PID:19172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6603.exe
        7⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25137.exe
        8⤵
        
        PID:17852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10610.exe
        8⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56687.exe
        7⤵
        
        PID:10628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63160.exe
        7⤵
        
        PID:15060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55484.exe
        7⤵
        
        PID:3764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8404.exe
        6⤵
        
        PID:216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25031.exe
        7⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43473.exe
        8⤵
        
        PID:8028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61896.exe
        8⤵
        
        PID:11368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43980.exe
        8⤵
        
        PID:16076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11071.exe
        8⤵
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21982.exe
        7⤵
        
        PID:8120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-887.exe
        7⤵
        
        PID:12396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49439.exe
        7⤵
        
        PID:15492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
        7⤵
        
        PID:1192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44143.exe
        6⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22801.exe
        7⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9325.exe
        8⤵
        
        PID:10952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7559.exe
        8⤵
        
        PID:16812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20665.exe
        8⤵
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58616.exe
        7⤵
        
        PID:9960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36581.exe
        7⤵
        
        PID:15068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-95.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-95.exe
        7⤵
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44757.exe
        6⤵
        
        PID:2160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9406.exe
        6⤵
        
        PID:10296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47591.exe
        6⤵
        
        PID:13624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38657.exe
        6⤵
        
        PID:18232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7866.exe
        6⤵
        
        PID:9408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37687.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44497.exe
        6⤵
        Executes dropped EXE
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25031.exe
        7⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43473.exe
        8⤵
        
        PID:7960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29806.exe
        8⤵
        
        PID:12660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59640.exe
        8⤵
        
        PID:16756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50346.exe
        8⤵
        
        PID:18380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21982.exe
        7⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-887.exe
        7⤵
        
        PID:12388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49439.exe
        7⤵
        
        PID:16312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
        7⤵
        
        PID:19196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12452.exe
        6⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22609.exe
        7⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1808.exe
        8⤵
        
        PID:10396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53192.exe
        8⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40927.exe
        8⤵
        
        PID:18280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14143.exe
        8⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9368 -s 448
        9⤵
        Program crash
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40956.exe
        7⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52232.exe
        7⤵
        
        PID:15052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-95.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-95.exe
        7⤵
        
        PID:18396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56079.exe
        6⤵
        
        PID:7268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57150.exe
        7⤵
        
        PID:17616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3655.exe
        6⤵
        
        PID:8820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64127.exe
        6⤵
        
        PID:13700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5210.exe
        6⤵
        
        PID:18604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53935.exe
        5⤵
        
        PID:3216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15982.exe
        6⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7040.exe
        7⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21102.exe
        8⤵
        
        PID:8836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe
        8⤵
        
        PID:10364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52239.exe
        8⤵
        
        PID:16248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
        8⤵
        
        PID:18804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51413.exe
        7⤵
        
        PID:9444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55292.exe
        7⤵
        
        PID:12668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-263.exe
        7⤵
        
        PID:16664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12623.exe
        7⤵
        
        PID:6968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25156.exe
        6⤵
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65352.exe
        6⤵
        
        PID:10596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31755.exe
        6⤵
        
        PID:13336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5471.exe
        6⤵
        
        PID:9364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65192.exe
        5⤵
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29345.exe
        6⤵
        
        PID:7220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59487.exe
        6⤵
        
        PID:11356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49845.exe
        6⤵
        
        PID:16028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50346.exe
        6⤵
        
        PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48575.exe
        5⤵
        
        PID:7560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54401.exe
        6⤵
        
        PID:13500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18919.exe
        6⤵
        
        PID:2016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46535.exe
        6⤵
        
        PID:19344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7863.exe
        5⤵
        
        PID:10352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32286.exe
        5⤵
        
        PID:14340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41236.exe
        5⤵
        
        PID:17644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50923.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57361.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61409.exe
        6⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33303.exe
        7⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39777.exe
        8⤵
        
        PID:12120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2375.exe
        8⤵
        
        PID:16260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53146.exe
        8⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5278.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64328.exe
        7⤵
        
        PID:14272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63871.exe
        7⤵
        
        PID:17472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63552.exe
        7⤵
        
        PID:4772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18311.exe
        6⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36561.exe
        7⤵
        
        PID:9000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62200.exe
        7⤵
        
        PID:12248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52239.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11071.exe
        7⤵
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16414.exe
        6⤵
        
        PID:9824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63352.exe
        6⤵
        
        PID:12332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11390.exe
        6⤵
        
        PID:15580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61166.exe
        6⤵
        
        PID:18384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28087.exe
        5⤵
        
        PID:116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33303.exe
        6⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49201.exe
        7⤵
        
        PID:11056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38503.exe
        7⤵
        
        PID:16016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53146.exe
        7⤵
        
        PID:18044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62005.exe
        6⤵
        
        PID:10316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52207.exe
        6⤵
        
        PID:15176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25038.exe
        6⤵
        
        PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32046.exe
        5⤵
        
        PID:6616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53089.exe
        6⤵
        
        PID:8744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39319.exe
        6⤵
        
        PID:11768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52239.exe
        6⤵
        
        PID:15200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
        6⤵
        
        PID:18884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15844.exe
        5⤵
        
        PID:8424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25854.exe
        5⤵
        
        PID:12736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34439.exe
        5⤵
        
        PID:16696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50876.exe
        5⤵
        
        PID:3028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37775.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31617.exe
        5⤵
        
        PID:4524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48111.exe
        6⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42350.exe
        7⤵
        
        PID:18020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33064.exe
        6⤵
        
        PID:10456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31755.exe
        6⤵
        
        PID:14372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5471.exe
        6⤵
        
        PID:13644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31767.exe
        5⤵
        
        PID:6524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21486.exe
        6⤵
        
        PID:8712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39319.exe
        6⤵
        
        PID:11680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52239.exe
        6⤵
        
        PID:16444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        6⤵
        
        PID:18776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30638.exe
        5⤵
        
        PID:8828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42792.exe
        5⤵
        
        PID:13236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7742.exe
        5⤵
        
        PID:17064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59086.exe
        5⤵
        
        PID:5740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48565.exe
      4⤵
      PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39905.exe
        5⤵
        
        PID:5608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62056.exe
        6⤵
        
        PID:7720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1275.exe
        6⤵
        
        PID:10964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13607.exe
        6⤵
        
        PID:15588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50346.exe
        6⤵
        
        PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe
        5⤵
        
        PID:7276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43151.exe
        5⤵
        
        PID:11156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60120.exe
        5⤵
        
        PID:15452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-486.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:18940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25406.exe
      4⤵
      PID:6000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60193.exe
        5⤵
        
        PID:7548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1232.exe
        6⤵
        
        PID:10380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53192.exe
        6⤵
        
        PID:13756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40927.exe
        6⤵
        
        PID:18320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25293.exe
        6⤵
        
        PID:18320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29415.exe
        5⤵
        
        PID:11112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54255.exe
        5⤵
        
        PID:15380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        5⤵
        
        PID:18144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19367.exe
      4⤵
      PID:9152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58289.exe
      4⤵
      PID:12340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28438.exe
      4⤵
      PID:16456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24010.exe
      4⤵
      PID:4648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16500.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16500.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57662.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44222.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6064.exe
        7⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50865.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10416.exe
        9⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7376.exe
        10⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30437.exe
        10⤵
        
        PID:15532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50346.exe
        10⤵
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33639.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:11036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38396.exe
        9⤵
        
        PID:14696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-102.exe
        9⤵
        
        PID:19044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57941.exe
        8⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61436.exe
        8⤵
        
        PID:12036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58104.exe
        8⤵
        
        PID:16236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63552.exe
        8⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32734.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7376.exe
        8⤵
        
        PID:3876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22718.exe
        8⤵
        
        PID:15292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64570.exe
        8⤵
        
        PID:18280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54117.exe
        7⤵
        
        PID:10976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35102.exe
        7⤵
        
        PID:14656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-632.exe
        7⤵
        
        PID:17712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37703.exe
        6⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60792.exe
        7⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16430.exe
        7⤵
        
        PID:11136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59336.exe
        7⤵
        
        PID:14752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-95.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-95.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38892.exe
        6⤵
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18071.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64127.exe
        6⤵
        
        PID:13708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21591.exe
        6⤵
        
        PID:18296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13201.exe
        6⤵
        
        PID:9392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6759.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39998.exe
        6⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18193.exe
        7⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21486.exe
        8⤵
        
        PID:8780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39319.exe
        8⤵
        
        PID:11748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4958.exe
        8⤵
        
        PID:16968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
        8⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16903.exe
        7⤵
        
        PID:8752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36927.exe
        7⤵
        
        PID:13248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16407.exe
        7⤵
        
        PID:17076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50346.exe
        7⤵
        
        PID:1132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2167.exe
        6⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21486.exe
        7⤵
        
        PID:8700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39319.exe
        7⤵
        
        PID:11624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52239.exe
        7⤵
        
        PID:16124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
        7⤵
        
        PID:18876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30446.exe
        6⤵
        
        PID:8880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42792.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56367.exe
        6⤵
        
        PID:17308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15080.exe
        6⤵
        
        PID:7132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51631.exe
        5⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11399.exe
        6⤵
        
        PID:7488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29502.exe
        6⤵
        
        PID:10600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42616.exe
        6⤵
        
        PID:14008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45701.exe
        6⤵
        
        PID:17608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
        5⤵
        
        PID:6328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9984.exe
        6⤵
        
        PID:12052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38503.exe
        6⤵
        
        PID:16472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53146.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20158.exe
        5⤵
        
        PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42391.exe
        5⤵
        
        PID:14040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39041.exe
        5⤵
        
        PID:18192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11771.exe
        5⤵
        
        PID:17688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21076.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58721.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32702.exe
        6⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22033.exe
        7⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33441.exe
        8⤵
        
        PID:12580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38503.exe
        8⤵
        
        PID:16184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24806.exe
        8⤵
        
        PID:13680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9223.exe
        7⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61727.exe
        7⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47176.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17666.exe
        7⤵
        
        PID:2620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43495.exe
        6⤵
        
        PID:6824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65352.exe
        6⤵
        
        PID:10824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63359.exe
        6⤵
        
        PID:14516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4402.exe
        6⤵
        
        PID:740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62696.exe
        5⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60673.exe
        6⤵
        
        PID:7104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59487.exe
        6⤵
        
        PID:10832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22824.exe
        6⤵
        
        PID:14748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4409.exe
        6⤵
        
        PID:17964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9182.exe
        5⤵
        
        PID:7408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52965.exe
        5⤵
        
        PID:10532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49711.exe
        5⤵
        
        PID:14412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1016.exe
        5⤵
        
        PID:18608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20603.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47969.exe
        5⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29345.exe
        6⤵
        
        PID:7228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13847.exe
        6⤵
        
        PID:9736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1390.exe
        6⤵
        
        PID:408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46792.exe
        6⤵
        
        PID:18256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62237.exe
        6⤵
        
        PID:17672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21879.exe
        5⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8173.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2375.exe
        6⤵
        
        PID:16296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53146.exe
        6⤵
        
        PID:18056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43151.exe
        5⤵
        
        PID:11244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49845.exe
        5⤵
        
        PID:16020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50346.exe
        5⤵
        
        PID:18444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32053.exe
      4⤵
      PID:5884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46293.exe
        5⤵
        
        PID:7648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-478.exe
        5⤵
        
        PID:11212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59336.exe
        5⤵
        
        PID:14768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-95.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-95.exe
        5⤵
        
        PID:18236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36091.exe
      4⤵
      PID:5468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58408.exe
      4⤵
      PID:10272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64657.exe
      4⤵
      PID:544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17126.exe
      4⤵
      PID:18264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19949.exe
      4⤵
      PID:17484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53694.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53694.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40942.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26241.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9764.exe
        6⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42046.exe
        7⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29415.exe
        7⤵
        
        PID:11148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7742.exe
        7⤵
        
        PID:15424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        7⤵
        
        PID:18768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20555.exe
        6⤵
        
        PID:9120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-887.exe
        6⤵
        
        PID:12380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49439.exe
        6⤵
        
        PID:15484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
        6⤵
        
        PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46360.exe
        5⤵
        
        PID:6016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13392.exe
        6⤵
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59070.exe
        7⤵
        
        PID:17828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3615.exe
        7⤵
        
        PID:6640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46904.exe
        6⤵
        
        PID:10280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1390.exe
        6⤵
        
        PID:14484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-102.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10718.exe
        5⤵
        
        PID:7576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43751.exe
        6⤵
        
        PID:13324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63583.exe
        6⤵
        
        PID:17132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe
        6⤵
        
        PID:18272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4423.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2430.exe
        5⤵
        
        PID:14588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-632.exe
        5⤵
        
        PID:19036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23588.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9764.exe
        5⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59233.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2999.exe
        6⤵
        
        PID:11312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7742.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        6⤵
        
        PID:18972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37743.exe
        5⤵
        
        PID:8172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55180.exe
        5⤵
        
        PID:12604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44247.exe
        5⤵
        
        PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25537.exe
        5⤵
        
        PID:7148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1399.exe
      4⤵
      PID:6188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26369.exe
        5⤵
        
        PID:5284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53077.exe
        5⤵
        
        PID:10496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59256.exe
        5⤵
        
        PID:16784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63552.exe
        5⤵
        
        PID:18900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21595.exe
      4⤵
      PID:8348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9319.exe
      4⤵
      PID:12788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51505.exe
      4⤵
      PID:16704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29345.exe
      4⤵
      PID:4244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63615.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63615.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58721.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46433.exe
        5⤵
        
        PID:5596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34337.exe
        6⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44734.exe
        7⤵
        
        PID:8008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61896.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54255.exe
        7⤵
        
        PID:15372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        7⤵
        
        PID:18964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9508.exe
        6⤵
        
        PID:9212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60559.exe
        6⤵
        
        PID:12292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58104.exe
        6⤵
        
        PID:16424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2406.exe
        6⤵
        
        PID:17980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58021.exe
        5⤵
        
        PID:6608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65352.exe
        5⤵
        
        PID:10944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20619.exe
        5⤵
        
        PID:14408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49487.exe
        5⤵
        
        PID:18644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10231.exe
      4⤵
      PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52017.exe
        5⤵
        
        PID:6432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47905.exe
        6⤵
        
        PID:8408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14919.exe
        6⤵
        
        PID:12728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53775.exe
        6⤵
        
        PID:16716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
        6⤵
        
        PID:5296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2679.exe
        5⤵
        
        PID:9816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57487.exe
        5⤵
        
        PID:13296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20055.exe
        5⤵
        
        PID:17404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-102.exe
        5⤵
        
        PID:18360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38892.exe
      4⤵
      PID:6664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56687.exe
      4⤵
      PID:10900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14992.exe
      4⤵
      PID:15496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29345.exe
      4⤵
      PID:3100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33063.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33063.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26981.exe
      4⤵
      PID:7328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63135.exe
      4⤵
      PID:11292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19652.exe
      4⤵
      PID:14248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1016.exe
      4⤵
      PID:18980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25838.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25838.exe
    3⤵
    PID:6112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45873.exe
      4⤵
      PID:7180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41838.exe
        5⤵
        
        PID:14332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27191.exe
        5⤵
        
        PID:18248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51908.exe
        5⤵
        
        PID:18300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63048.exe
      4⤵
      PID:10256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1390.exe
      4⤵
      PID:4652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46792.exe
      4⤵
      PID:18344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32771.exe
      4⤵
      PID:18256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11430.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11430.exe
    3⤵
    PID:7440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46673.exe
      4⤵
      PID:17604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61699.exe
      4⤵
      PID:18064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14015.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14015.exe
    3⤵
    PID:11132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29319.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29319.exe
    3⤵
    PID:15440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16152.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16152.exe
    3⤵
    PID:18704
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49355.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49355.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52215.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52215.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39844.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37924.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57553.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60065.exe
        7⤵
        
        PID:808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56956.exe
        8⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3655.exe
        8⤵
        
        PID:10444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33950.exe
        8⤵
        
        PID:14208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37159.exe
        8⤵
        
        PID:17524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25038.exe
        8⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46360.exe
        7⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45022.exe
        8⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59487.exe
        8⤵
        
        PID:10880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6487.exe
        8⤵
        
        PID:14596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22006.exe
        8⤵
        
        PID:13676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26862.exe
        7⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20145.exe
        8⤵
        
        PID:15852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32799.exe
        8⤵
        
        PID:19336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4423.exe
        7⤵
        
        PID:10892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36363.exe
        7⤵
        
        PID:14532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10078.exe
        7⤵
        
        PID:6960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10215.exe
        6⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31441.exe
        7⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3693.exe
        8⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7376.exe
        9⤵
        
        PID:9532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22718.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:14840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16630.exe
        9⤵
        
        PID:9376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3655.exe
        8⤵
        
        PID:8844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42511.exe
        8⤵
        
        PID:14100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56501.exe
        8⤵
        
        PID:17628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60812.exe
        7⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-487.exe
        7⤵
        
        PID:12556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59118.exe
        7⤵
        
        PID:16140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28110.exe
        7⤵
        
        PID:18420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13198.exe
        6⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15697.exe
        7⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7.exe
        7⤵
        
        PID:10324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1390.exe
        7⤵
        
        PID:13916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-99.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-99.exe
        7⤵
        
        PID:18248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48680.exe
        6⤵
        
        PID:7632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63215.exe
        6⤵
        
        PID:11184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34135.exe
        6⤵
        
        PID:14736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44638.exe
        6⤵
        
        PID:18276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24039.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45265.exe
        6⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8301.exe
        7⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54079.exe
        8⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55180.exe
        8⤵
        
        PID:12680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44247.exe
        8⤵
        
        PID:17372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59086.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44648.exe
        7⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47100.exe
        7⤵
        
        PID:10508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58376.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49487.exe
        7⤵
        
        PID:18996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14471.exe
        6⤵
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43473.exe
        7⤵
        
        PID:7904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12695.exe
        7⤵
        
        PID:11072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23419.exe
        7⤵
        
        PID:14352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        7⤵
        
        PID:3988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25653.exe
        6⤵
        
        PID:9952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55564.exe
        6⤵
        
        PID:13160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60392.exe
        6⤵
        
        PID:16464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18395.exe
        6⤵
        
        PID:4348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41823.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33303.exe
        6⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7376.exe
        7⤵
        
        PID:8932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28884.exe
        7⤵
        
        PID:13396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33038.exe
        7⤵
        
        PID:17660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62005.exe
        6⤵
        
        PID:9964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52207.exe
        6⤵
        
        PID:14896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25038.exe
        6⤵
        
        PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51368.exe
        5⤵
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26209.exe
        6⤵
        
        PID:9148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30437.exe
        6⤵
        
        PID:15524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63552.exe
        6⤵
        
        PID:5516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50828.exe
        5⤵
        
        PID:9248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23175.exe
        5⤵
        
        PID:14088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13664.exe
        5⤵
        
        PID:16976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21966.exe
        5⤵
        
        PID:19368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34202.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2224
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 724
        5⤵
        Program crash
        
        PID:4796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37775.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10039.exe
        5⤵
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3693.exe
        6⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36561.exe
        7⤵
        
        PID:8856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe
        7⤵
        
        PID:11440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52239.exe
        7⤵
        
        PID:15796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14143.exe
        7⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9356 -s 424
        8⤵
        Program crash
        
        PID:18412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12875.exe
        6⤵
        
        PID:8188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48101.exe
        6⤵
        
        PID:13748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29470.exe
        6⤵
        
        PID:16752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42575.exe
        6⤵
        
        PID:19404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15902.exe
        5⤵
        
        PID:6376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23521.exe
        6⤵
        
        PID:8720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30437.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50346.exe
        6⤵
        
        PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12103.exe
        5⤵
        
        PID:10108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43276.exe
        5⤵
        
        PID:14032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21975.exe
        5⤵
        
        PID:18172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37804.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31352.exe
      4⤵
      PID:2456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50901.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10941.exe
        6⤵
        
        PID:9240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30437.exe
        6⤵
        
        PID:15624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50346.exe
        6⤵
        
        PID:1760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3659.exe
        5⤵
        
        PID:9584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65205.exe
        5⤵
        
        PID:14284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63871.exe
        5⤵
        
        PID:17504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10030.exe
      4⤵
      PID:6548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27454.exe
        5⤵
        
        PID:9024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62200.exe
        5⤵
        
        PID:12268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52239.exe
        5⤵
        
        PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
        5⤵
        
        PID:18836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11879.exe
      4⤵
      PID:9480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53022.exe
      4⤵
      PID:12756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36710.exe
      4⤵
      PID:17396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22775.exe
      4⤵
      PID:1228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63506.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63506.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39406.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19422.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53921.exe
        6⤵
        
        PID:960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62001.exe
        7⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40209.exe
        8⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8173.exe
        9⤵
        
        PID:12072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2375.exe
        9⤵
        
        PID:16252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5206.exe
        9⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29415.exe
        8⤵
        
        PID:11000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23419.exe
        8⤵
        
        PID:14812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        8⤵
        
        PID:18924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1620.exe
        7⤵
        
        PID:8692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53055.exe
        7⤵
        
        PID:11744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58104.exe
        7⤵
        
        PID:16096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50346.exe
        7⤵
        
        PID:19124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64632.exe
        6⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21486.exe
        7⤵
        
        PID:8736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39319.exe
        7⤵
        
        PID:11816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52239.exe
        7⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        7⤵
        
        PID:18948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30062.exe
        6⤵
        
        PID:8924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25688.exe
        6⤵
        
        PID:12460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58588.exe
        6⤵
        
        PID:14552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48034.exe
        6⤵
        
        PID:17600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17527.exe
        5⤵
        
        PID:1220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42543.exe
        6⤵
        
        PID:8228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5879.exe
        6⤵
        
        PID:11500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41180.exe
        6⤵
        
        PID:16068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
        6⤵
        
        PID:18436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37823.exe
        5⤵
        
        PID:6500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56687.exe
        5⤵
        
        PID:10856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15220.exe
        5⤵
        
        PID:14604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53751.exe
        5⤵
        
        PID:6404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65093.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54305.exe
        5⤵
        
        PID:532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29630.exe
        6⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27521.exe
        7⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29806.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1982.exe
        7⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
        7⤵
        
        PID:19164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38423.exe
        6⤵
        
        PID:9092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60559.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58104.exe
        6⤵
        
        PID:15652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54871.exe
        6⤵
        
        PID:18404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17550.exe
        5⤵
        
        PID:8136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49016.exe
        5⤵
        
        PID:11028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20619.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49487.exe
        5⤵
        
        PID:18788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64319.exe
      4⤵
      PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34913.exe
        5⤵
        
        PID:5868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9648.exe
        6⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17873.exe
        7⤵
        
        PID:11856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38503.exe
        7⤵
        
        PID:16408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53146.exe
        7⤵
        
        PID:2032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51816.exe
        6⤵
        
        PID:11448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43980.exe
        6⤵
        
        PID:16060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
        6⤵
        
        PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23623.exe
        5⤵
        
        PID:7312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60559.exe
        5⤵
        
        PID:11736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58104.exe
        5⤵
        
        PID:15732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20937.exe
        5⤵
        
        PID:936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22536.exe
      4⤵
      PID:7036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23521.exe
        5⤵
        
        PID:8892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30437.exe
        5⤵
        
        PID:15516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50346.exe
        5⤵
        
        PID:19132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4014.exe
      4⤵
      PID:9992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42391.exe
      4⤵
      PID:13972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39041.exe
      4⤵
      PID:18156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54600.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54600.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52286.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe
        5⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29630.exe
        6⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27521.exe
        7⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29806.exe
        7⤵
        
        PID:12644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1982.exe
        7⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6820.exe
        6⤵
        
        PID:9132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60559.exe
        6⤵
        
        PID:12308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58104.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50346.exe
        6⤵
        
        PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2935.exe
        5⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42657.exe
        6⤵
        
        PID:11908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38503.exe
        6⤵
        
        PID:16400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3286.exe
        6⤵
        
        PID:18716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7006.exe
        5⤵
        
        PID:9860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16087.exe
        5⤵
        
        PID:13520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17160.exe
        5⤵
        
        PID:9384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4948.exe
      4⤵
      PID:5168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42543.exe
        5⤵
        
        PID:8236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54696.exe
        5⤵
        
        PID:11492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41180.exe
        5⤵
        
        PID:16048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51408.exe
        5⤵
        
        PID:392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38892.exe
      4⤵
      PID:6632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56687.exe
      4⤵
      PID:10816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63160.exe
      4⤵
      PID:14668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53948.exe
      4⤵
      PID:17872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43356.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43356.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37585.exe
      4⤵
      PID:2164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46383.exe
        5⤵
        
        PID:8496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7296.exe
        6⤵
        
        PID:12144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2375.exe
        6⤵
        
        PID:16288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53146.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39896.exe
        5⤵
        
        PID:12024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13310.exe
        5⤵
        
        PID:16272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
        5⤵
        
        PID:19180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36684.exe
      4⤵
      PID:6168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16151.exe
      4⤵
      PID:10560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31755.exe
      4⤵
      PID:1168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5471.exe
      4⤵
      PID:18172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11927.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11927.exe
    3⤵
    PID:5124
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5124 -s 640
      4⤵
      Program crash
      PID:6216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64177.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64177.exe
    3⤵
    PID:6852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31201.exe
      4⤵
      PID:10204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42999.exe
      4⤵
      PID:13964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49100.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61843.exe
      4⤵
      PID:18620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47014.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47014.exe
    3⤵
    PID:9644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29327.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29327.exe
    3⤵
    PID:14228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41735.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41735.exe
    3⤵
    PID:17496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63272.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63272.exe
    3⤵
    PID:7144
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46085.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46085.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39844.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39844.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31739.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39697.exe
        5⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5092.exe
        6⤵
        
        PID:8672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61324.exe
        6⤵
        
        PID:13196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56744.exe
        6⤵
        
        PID:17056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-632.exe
        6⤵
        
        PID:17528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58405.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10002.exe
        6⤵
        
        PID:968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12206.exe
        5⤵
        
        PID:10368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7255.exe
        5⤵
        
        PID:13800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38126.exe
        5⤵
        
        PID:18328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32572.exe
        5⤵
        
        PID:18348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22904.exe
      4⤵
      PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28561.exe
        5⤵
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42046.exe
        6⤵
        
        PID:6220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29415.exe
        6⤵
        
        PID:11228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26382.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
        6⤵
        
        PID:19116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6820.exe
        5⤵
        
        PID:9200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60559.exe
        5⤵
        
        PID:12300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58104.exe
        5⤵
        
        PID:16136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50346.exe
        5⤵
        
        PID:19140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13870.exe
      4⤵
      PID:7020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52705.exe
        5⤵
        
        PID:7044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47701.exe
        5⤵
        
        PID:11872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52239.exe
        5⤵
        
        PID:15968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
        5⤵
        
        PID:18812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11879.exe
      4⤵
      PID:9488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18435.exe
      4⤵
      PID:13764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35231.exe
      4⤵
      PID:4532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20007.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20007.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39697.exe
      4⤵
      PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51249.exe
        5⤵
        
        PID:3944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43857.exe
        6⤵
        
        PID:7848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53077.exe
        6⤵
        
        PID:11328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38988.exe
        6⤵
        
        PID:14800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        6⤵
        
        PID:18636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57832.exe
        5⤵
        
        PID:9176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60559.exe
        5⤵
        
        PID:12316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58104.exe
        5⤵
        
        PID:15612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50346.exe
        5⤵
        
        PID:19148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19079.exe
      4⤵
      PID:7068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46204.exe
        5⤵
        
        PID:3200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6814.exe
      4⤵
      PID:10028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2055.exe
      4⤵
      PID:13952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64639.exe
      4⤵
      PID:17944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64019.exe
      4⤵
      PID:6860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30574.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30574.exe
    3⤵
    PID:5268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50865.exe
      4⤵
      PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10416.exe
        5⤵
        
        PID:6544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12695.exe
        5⤵
        
        PID:7844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5054.exe
        5⤵
        
        PID:15432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        5⤵
        
        PID:18668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18526.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64229.exe
      4⤵
      PID:13184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11390.exe
      4⤵
      PID:16752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48103.exe
      4⤵
      PID:17952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53708.exe
      4⤵
      PID:7624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62872.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62872.exe
    3⤵
    PID:7012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4736.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4736.exe
    3⤵
    PID:9848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51958.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51958.exe
    3⤵
    PID:13816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38303.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38303.exe
    3⤵
    PID:17928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31042.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31042.exe
    3⤵
    PID:7616
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6906.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6906.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36855.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36855.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44782.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45073.exe
        5⤵
        
        PID:1860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12800.exe
        6⤵
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10416.exe
        7⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61896.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23419.exe
        7⤵
        
        PID:14732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57941.exe
        6⤵
        
        PID:8148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63845.exe
        6⤵
        
        PID:12824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60783.exe
        6⤵
        
        PID:17348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1330.exe
        6⤵
        
        PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1591.exe
        5⤵
        
        PID:6656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10941.exe
        6⤵
        
        PID:9228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22718.exe
        6⤵
        
        PID:14864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16630.exe
        6⤵
        
        PID:18368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35647.exe
        5⤵
        
        PID:9496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64328.exe
        5⤵
        
        PID:14264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63871.exe
        5⤵
        
        PID:17448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28964.exe
      4⤵
      PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16507.exe
        5⤵
        
        PID:7920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33064.exe
        5⤵
        
        PID:10392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44527.exe
        5⤵
        
        PID:1600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65100.exe
        5⤵
        
        PID:9400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20043.exe
      4⤵
      PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6960.exe
        5⤵
        
        PID:7188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17873.exe
        6⤵
        
        PID:12476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38503.exe
        6⤵
        
        PID:15412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53146.exe
        6⤵
        
        PID:4200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29415.exe
        5⤵
        
        PID:10968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23419.exe
        5⤵
        
        PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        5⤵
        
        PID:18732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52824.exe
      4⤵
      PID:8756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50255.exe
      4⤵
      PID:11688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32903.exe
      4⤵
      PID:14392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2936.exe
      4⤵
      PID:4664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56520.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56520.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46142.exe
      4⤵
      PID:3796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33303.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37438.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe
        6⤵
        
        PID:11364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52239.exe
        6⤵
        
        PID:15664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
        6⤵
        
        PID:4432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15947.exe
        5⤵
        
        PID:9544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39436.exe
        5⤵
        
        PID:13728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12935.exe
        5⤵
        
        PID:376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59641.exe
        5⤵
        
        PID:19396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64632.exe
      4⤵
      PID:6560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9581.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44629.exe
        5⤵
        
        PID:13176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14190.exe
        5⤵
        
        PID:16828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
        5⤵
        
        PID:836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53135.exe
      4⤵
      PID:9512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48376.exe
      4⤵
      PID:14076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46684.exe
      4⤵
      PID:17096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8766.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8766.exe
    3⤵
    PID:4300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33303.exe
      4⤵
      PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26193.exe
        5⤵
        
        PID:9044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62200.exe
        5⤵
        
        PID:12240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52239.exe
        5⤵
        
        PID:15388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
        5⤵
        
        PID:5320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19294.exe
      4⤵
      PID:9864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63352.exe
      4⤵
      PID:12488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11390.exe
      4⤵
      PID:17392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18666.exe
      4⤵
      PID:7140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25909.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25909.exe
    3⤵
    PID:5980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39825.exe
      4⤵
      PID:6212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7136.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57287.exe
        5⤵
        
        PID:1104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29415.exe
      4⤵
      PID:11012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23419.exe
      4⤵
      PID:14708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
      4⤵
      PID:18652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27822.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27822.exe
    3⤵
    PID:8800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51317.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51317.exe
    3⤵
    PID:11280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49969.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49969.exe
    3⤵
    PID:16148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17150.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17150.exe
    3⤵
    PID:4972
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22135.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22135.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47969.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22609.exe
        5⤵
        
        PID:7096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36561.exe
        6⤵
        
        PID:8848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe
        6⤵
        
        PID:11380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52239.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1335.exe
        5⤵
        
        PID:9472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55292.exe
        5⤵
        
        PID:12620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-263.exe
        5⤵
        
        PID:16484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20553.exe
        5⤵
        
        PID:788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25156.exe
      4⤵
      PID:6236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23777.exe
        5⤵
        
        PID:15448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39410.exe
        5⤵
        
        PID:1960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12206.exe
      4⤵
      PID:10356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7255.exe
      4⤵
      PID:2264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17160.exe
      4⤵
      PID:1376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10894.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10894.exe
    3⤵
    PID:6044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43953.exe
      4⤵
      PID:6252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59487.exe
      4⤵
      PID:10916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6487.exe
      4⤵
      PID:14556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5478.exe
      4⤵
      PID:9344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15047.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15047.exe
    3⤵
    PID:7420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10558.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10558.exe
    3⤵
    PID:10476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33175.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33175.exe
    3⤵
    PID:14400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45022.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45022.exe
    3⤵
    PID:18932
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18439.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18439.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31617.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31617.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33303.exe
      4⤵
      PID:6756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21486.exe
        5⤵
        
        PID:8768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39319.exe
        5⤵
        
        PID:11692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52239.exe
        5⤵
        
        PID:15560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30672.exe
        5⤵
        
        PID:13652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30446.exe
      4⤵
      PID:8816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42792.exe
      4⤵
      PID:13288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56367.exe
      4⤵
      PID:17320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33810.exe
      4⤵
      PID:19204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64632.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64632.exe
    3⤵
    PID:6568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36369.exe
      4⤵
      PID:8948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe
      4⤵
      PID:11476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52239.exe
      4⤵
      PID:1428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
      4⤵
      PID:18828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34094.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34094.exe
    3⤵
    PID:9564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61157.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61157.exe
    3⤵
    PID:12640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57711.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57711.exe
    3⤵
    PID:16308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32575.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32575.exe
    3⤵
    PID:18400
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39361.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39361.exe
  2⤵
  PID:4988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56241.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56241.exe
    3⤵
    PID:5892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54079.exe
      4⤵
      PID:7164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55180.exe
      4⤵
      PID:12764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44247.exe
      4⤵
      PID:17328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50876.exe
      4⤵
      PID:4176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44648.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44648.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35937.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40039.exe
      4⤵
      PID:16744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53146.exe
      4⤵
      PID:4904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47100.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47100.exe
    3⤵
    PID:10516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58376.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58376.exe
    3⤵
    PID:14420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22558.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22558.exe
    3⤵
    PID:18012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49103.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49103.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:18312
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21702.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21702.exe
  2⤵
  PID:6516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3504.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3504.exe
    3⤵
    PID:8912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe
    3⤵
    PID:4660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52239.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52239.exe
    3⤵
    PID:15368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
    3⤵
    PID:18452
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52815.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52815.exe
  2⤵
  PID:9876
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33428.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33428.exe
  2⤵
  PID:13040
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27056.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27056.exe
  2⤵
  PID:15800
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62104.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62104.exe
  2⤵
  PID:17920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2224 -ip 2224
1⤵
PID:3080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5124 -ip 5124
1⤵
PID:5468

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:18104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 9356 -ip 9356
1⤵
PID:19052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 9368 -ip 9368
1⤵
PID:5996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12206.exe

Filesize
184KB

MD5
dcf0ec39a35f9d1584e201b06102c586

SHA1
47c26793ec878a668a3853dc2326df97076960b8

SHA256
ffc178dd20ae53541d675616e87643ebf4e2ede970646408b5a679aed60be7b3

SHA512
e2c8b1de56fd55fc7175978a79dc6ed67e6c5df330643767599144a7e9a0e397d28809a58ec73f4b1f704ea2308b1bbc7ea27296170514078257e5bf484d87f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16500.exe

Filesize
184KB

MD5
391dac8cd5780c604ac9c032aa8e1b37

SHA1
6d6db056fd07c3db373890d8216d30130e22d3aa

SHA256
84f9f1f412967c9071d6d0c519d50c871eced230d7bb086b7bb2629b3ea499bc

SHA512
1e89dcd3ba30dda72ef61666c6199e25861f72b2ef2f8d552644524d4e5a0f3505c0f9615b377275b0391991afb40ba2a710b86743f93ccd56aa9a8a3f397dad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17214.exe

Filesize
184KB

MD5
a4c8d8c1e53f0cdc4ba54feafd89a9d7

SHA1
6520ed3777c721b8312bd35a507fc2de53e5e531

SHA256
005192d98fd8db1f749b67df6a8744b4b958f6577d0bbd6df98b861dad981e6f

SHA512
7a8f7e56b28db6ba1d8009d43d8a317f8179c0a6f76e102cec97a2462f8b87f0217658eecf89e1651fa495fd4c3e41a9759cc34fcb85bdd95ee8b69d791008ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17274.exe

Filesize
184KB

MD5
7234f2e66e8068dd2fa40f93424e46c3

SHA1
9567d5995d7620b793c2058157855f10a7d60744

SHA256
143129204b692f41a475dba158a07ae50226931bb1c1d1993003fc3acfec3068

SHA512
e123ecfbc19f7f720df6705c35da966af53068200df57cbd11be8c16faf6ae56957ac27512e969ad9c411d4968545a4d447fc10b7bc5a3c20176066189480e75

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21076.exe

Filesize
184KB

MD5
defebf921acf126d5ed3e3b93018ba3a

SHA1
cba716e03ed97dd237a6f404ec50a4e63aaffa07

SHA256
d4455bad1ca2e38eba42430b6642380c7c1c59afe8cdd8bc9e2a99af1fb1cbb9

SHA512
7e4ad7402c807fc90aa2e814ad8e6bd197712ef013d758f34648b2443097aca7979059e987330ad8b66b6f94006fb0072db94ac7d628ac8878f7381e80793466

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22631.exe

Filesize
184KB

MD5
b0575e8895942691cd51d95394e7e3de

SHA1
fcc0d2879fa7f65558dc4ec40c3c7115fdd64a3a

SHA256
58ed12caeb1fd82c3e9d1c53874a3a955e4d711a89246528b68c8b187b0ee23b

SHA512
b8c5ce37c40fca6165a8de8a941efc97813fc013ae93e9947c7d221eed8861d69c6ca77119ebdeda07160faed0700560e6ec74a6113a28c226045853aeea6581

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26241.exe

Filesize
184KB

MD5
24a17ca23694b9460d6446a2b4fa652d

SHA1
5a76c1a3b9f61bb5468a43ea5b396d7b7a686587

SHA256
b8526e08d14f47b9044d46c0c038adcf1863066357e51aae08e88a5e55fcebfa

SHA512
29f58c02aeca9ad82c2a49a21a6ad40bd58aa300ae44ff5c5885d6384db3c4d682bfcbb64653a0f4d816fed04f22341673274ef3375ab7f25491ad62667816a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31601.exe

Filesize
184KB

MD5
67923ac67282f618b3f85f08d998ac37

SHA1
8e5bc76dd4dcb34a8e6ca3f00d6017844cf704a9

SHA256
c36ebb804e58e0c9b8d0cf555afa60fc5b84ed5366ba91dd94d38e7f7a866124

SHA512
51a01e2d7abb6aa3cd0cc81749bbd27fb740ab2aa51c1d7ce95a2085bd1f3a877ece49bf3435dc201892d9040a1aa74f325cc072c03a949e5927b0d50448a95b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3398.exe

Filesize
184KB

MD5
953b54a940ad28a02d1a15da56c44d95

SHA1
c6637d75cac4763be4fb47b712d0112b86309ce1

SHA256
6537d8553ae575217734db6791a63c549050cf3c09b68d4727c858732032ef53

SHA512
2dd17f6b3c1a9c9d07dc310de5de8f76cb0ba503f7f738b8e2d5bcc0cec0e1c0f79c3584546f0f923905e7dacf93908d95a59fea071b5ea54497da499f159775

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34202.exe

Filesize
184KB

MD5
bb057bd6ec6e15d6994f1282c6274c12

SHA1
bcfb893b7ce4d443dae6ed8a34d729250ff55778

SHA256
e2825fb96163ce289571ea4c8a4059862fec9de719d85973d0b6858b44c965df

SHA512
883c88cbe0a5440eebe92468e70514a0d8d705a2a5e442528b11d3ecc5a178163c708f5323d95772219837b3da92494de1209dd7c79d15ea4a5422b94dd9caaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34750.exe

Filesize
184KB

MD5
2142a34fa5de28ec3f3c9a7a561ede34

SHA1
f40d296b3db117d6ff5dea031ba67ec3925a2698

SHA256
7b32bf154d246d58289148a4d713cb90861f3bb44a321641f10a63999744950e

SHA512
410845f90a4b29e019c50cf2bd3d12892196b10f4f84acad35549e78e0a216659569150f4d8671e4a016eb4f9138f4ae1b44ff5077b660bb35f581f5d6a0499f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36855.exe

Filesize
184KB

MD5
128429fa1ce27ba632ec433eca11932b

SHA1
1088e22fcb01004ed4c416fb7e5da34076bac3fd

SHA256
203471e6a8670f873f683f667bc31c2fe92ed7e62cc4bdb6bfc49e33c8279b72

SHA512
9b8d2de0949acf6727c959dfe855207e8feadaea1046eb7091cab5652221baaa008da5d713e26dc902b5b1437521e522c526b52727fe409354748e60090ec780

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37924.exe

Filesize
184KB

MD5
2f5a732738c20131e3675d6e6bc6f457

SHA1
a364d7ada3bd01c1d4add85c0763b9ba79734c27

SHA256
1a9705b3f8a6ea588376cede58edbfbd1a96de71f8604821dc346b0fcd49ede8

SHA512
b0176779d111685441caad1d870d8d1e885c830737ce871d2e210eda976cc0bd940e484aecef6cda2b5656f63b6744b60c3d036e40db4f95ff5f1c6594f0ce52

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe

Filesize
184KB

MD5
cafc2ee8e678fc8283d84799b5aec985

SHA1
9cf72df6f677f2227ce5e83b9100fb224b259dfd

SHA256
de74f00b6b72957d03580ce554ff9bb80e94ebd79d5de6f411d2e25b53e1b6ac

SHA512
4c7c85445577fd7e70a0d475ad685a507ceaa8b0872e5ab010f3b4bb4b55126177c0dc9808bf35ce8bb0eb0305f2a5273f940363668103260dd94ceb634037f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39406.exe

Filesize
184KB

MD5
19f4b84a975042490aeba5e14ec65c82

SHA1
816e3c49d1f2bca9f971232aaa28aa9dcd040eec

SHA256
ecf7fbbdbe42898d349513567f361bc3d0df0aa2ee3fe8732f7bed4303f31bc2

SHA512
3761794e71f0a9a5f46fd74d84b441517688c0009ae793bcc3c3aba9b933373b90626bfa97522d8c1b7ec25116d3a92c21501153e6b7163f68f144bb9a952093

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39844.exe

Filesize
184KB

MD5
35cdfc88cdad5cd082a7ce8941182d23

SHA1
33e2f8992ba5250644a86cdaec455763965118e6

SHA256
e27acd26a109e7929d48c35e15bc2851bee5811a6731c21eda98a8d524b814a7

SHA512
aa7a327b321c98987c43691d9888e06504bb722d59f2f9545d2aa052c4f9a9608f646433a3b3078ea523f56a3776725f41a95fd9d21bb19e98b3440fecf6754f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4067.exe

Filesize
184KB

MD5
433309d47c05f499a5a6e4b8001f9dd5

SHA1
b1cf5c62a1a13a5294f8cf50870aa8b671460d06

SHA256
a2259600795a4d46afa269865a80431e16ef6499f1dd1f2d787bc2b2c3fe52d3

SHA512
633b1d46ba162645ca5b79b6fa9d2ac47b93e531b0a9b1b151aabf0066e4afe4e08e87c4365f2a01c2b490837ffe3dca88bef5669dea74eaeea953f864e5d40b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40942.exe

Filesize
184KB

MD5
f86c51a6798eec7e858fb927e74176eb

SHA1
b12ffca9472c85da167db6578a5687521d543635

SHA256
f537b8ee11cba82129e595e2260352f3e67dc0feebfee6eb7852b5ec0d3243f5

SHA512
1ae72780e33ea9ee99eddef299bd05f1eabcbe8165908756878a7da3c79204ef2d2de70691b9f15075fe959ab584e02af31201be916d87d31bcd00576387e4d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe

Filesize
184KB

MD5
fdd732b44cab8a9a2e6a6c5df556b5d7

SHA1
607407797435dd04aee1f0609849181f6d92e127

SHA256
ff6861ac0a4a146f3394ebccfcf7893402e0b17a6035f18add7271ed25d5da98

SHA512
caa23aebaf710e945b288ebab5fa2f81be5bad960d906ee99e7825ef844c4f19258c9b3cf1b49bb2b86c3101226d85a1a5a86bfd31448c3a707c204b837f97a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46085.exe

Filesize
184KB

MD5
2cc31328921c85f9f1476598f4162b51

SHA1
c3d72ef46b4abb623cda54c4889819b29d8b0cd0

SHA256
3adb27067ae2add90bcd1c0fc4e3bd422585994d437f53a5ad0a0bbed73c26bc

SHA512
a718913c96ef9da7672337235aae67b0ab31cc541153d8a3a8edf7fc668e87decfa046fd307a86281a06cc282c7779824921ff095df4907840f767214c443d6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48111.exe

Filesize
184KB

MD5
8921b4633e2a88c739e7bb5a64e1b6d0

SHA1
f9b082f745318c4ea0eb913ebac80528c0c60755

SHA256
2f54db145b59127ffcec9688ddd8631ed7174be53d1e687397e14552f3db272d

SHA512
90a64703bf96222f582b151031a8d6c7fa4ab0417271b3f85e963e9f99d5122602ae9c10b40474121c918198f408e9c34df6af63b2a04018f6b06b756df06201

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49355.exe

Filesize
184KB

MD5
d0a8414aa9571034b10c10fd19b1aa8a

SHA1
891a3ac2247afe1ecb00fe5b5191ca80ffb56b07

SHA256
521ca02fa0ffb2350a519adba7acd18f812ad0d54327b57b329a9a3190676024

SHA512
842a1e6084d237c502232c4ed63ac36ccb9d5812274625f773b26fa326e392af78278f2e2b40d9b075aa91dbba68dd321277792144e5837811b7938477757896

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50923.exe

Filesize
184KB

MD5
db702d28a15d0da662f0ddc00106c61a

SHA1
cd337efc4fd25b5f4db0405add7ea1989820f7bd

SHA256
1d25514e763bab7f9fddf773a49714c929ace63160d061c36136dc7f849ca24b

SHA512
29ca11701acf2ebb17548fdf17c89b682d94905c8d5e6f61e4c39936e198fdc6a354df0006d5c84ab69b90cc4f5a00cc3ca942c3d012ed76d53347e23b3956c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52215.exe

Filesize
184KB

MD5
562701d87dcf7ee1cb789d755d06a9ca

SHA1
b611c10620ae09ac41f144a1fb6a52e7943267f4

SHA256
7a4c270e93f18fa82539e3a58a3461699d33b1c4509c51ba3f1ab6e42a948f7e

SHA512
1354c72f2f44e9a1932d1685ebb5cb520bb96bbdb975f7e4e50875435829b93a55f8a5a87a50bc7ec4f179fa098c8abbdc577efda6a4d38898722e3515356d0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52843.exe

Filesize
184KB

MD5
cd43203a053f731d433c8bb7b8f64d9f

SHA1
d8be04f6dd81e1b17f8c147964c3fdbab3332395

SHA256
03e9273ba2a1f8e51b327b2acae7d7ea37b862d1991031bb83079a3c3e0037c5

SHA512
8b9ff38781ec760b69f07ee6d355ad85ba432405ec25093c391b72406f993daccd1faf68d998b1fbad3f6683342e6ebc19a30ac8e679a9c142e6e8b7c8e27f1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53076.exe

Filesize
184KB

MD5
e908d10977777f6fbcc5906f2e7cf686

SHA1
efbac0d6cba4bea36af6a6ab1c5f3a632494298c

SHA256
4d13075d07f152114cd0418ace33f5de2404957074602ce683c86da5eb2c8c70

SHA512
6dad840e2d931897e1f1dd7260bb75022b87fafc5c5c8c0d702e0377b852da34b476e17f59a4102f592ef404aa9fbbc9e4d854e66f61c6d1d0e534c7306028cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53575.exe

Filesize
184KB

MD5
25f717f78a5de213a53c275ba8a4e705

SHA1
42cb6d9d5d6d52432ca44852bec4d112ee3267be

SHA256
bc41517892255941930d84451e3ffcaef83195f10224a6cfe71be9649e541bfa

SHA512
beb41b24014304d8044e87c3e491b49f25a94d3701105cf90be7ca726dacfa604520a84e1aed2e1fb3c05e3d9e0afe3ce127c64a99990bc95a6e2058f11067ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53694.exe

Filesize
184KB

MD5
36d21dd862bfbb2ff2cb4069a334516e

SHA1
87507356b2359d34096246e517782463de94d240

SHA256
9f26736813803ab2cc3bc181e1621470345bd1711b525b7b59eb3a24c04cdc5a

SHA512
48fc9abf7c689e65b539fea7b8418cc8500e88cf462a12d065697100085a423abb8069ce695d39337ec9a2914a6a0e2becf590c606a05d3180e8f7f6f32d263f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54600.exe

Filesize
184KB

MD5
e9456b1dc998665a8cf0cbddccbb7e54

SHA1
7fc66d0c82c48065fc9cd169ba49a427423d2dc1

SHA256
ccb24d57dd9c4af05803fa80a9aa2ddea343c6e8a11679d3f0fc88884977727d

SHA512
3f5daf0a261d8f7475e749309771fe22c76e486586c38131dbf3594a01dbf7ca559150870177f771d7fb5b8074387655381ee941de371d3721f6f4ad548eb150

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57662.exe

Filesize
184KB

MD5
35175fcf7d9cc33d0600892877c90995

SHA1
efb7e08e5aac77289ce1677cfc8aa2f70f682619

SHA256
b355ffdfb1eca822d1d1ac1e30ea0bc5076375e06195fbf1050ca9c9515a01e3

SHA512
42b7181f6cf0a03f3d5b41f4f252027b2325e5e442e6f7bc4e6e6f56691d5922445983c087023032001e8eeac533f7dca6728997f20dc97a8cb4f0c77cb1275c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57941.exe

Filesize
184KB

MD5
48bbdf78de643f6f4637a5c757e56726

SHA1
4ee91163c7cf8c4cf1831e287deb5e29286d2b30

SHA256
30ef7c75c5850567035934503fdabc298323365b944a13e297c0bf9ff9c4db66

SHA512
57804126ebba3e51cd1db24f4233644c1801a042ee619470028737f74dcf815f54061d3efa1f3982a468a2a03bb0f44c9582c2d3debdabd9f75b9507ae774622

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63506.exe

Filesize
184KB

MD5
d6be7eff16004d9226aafe1533f05027

SHA1
b338202a30bacf83bd4462a3c688234c678dbd00

SHA256
6b4195276637c34fdfe97ff41b119e889f2d0c77c6aae0db806447d5db2c3a60

SHA512
5c0880ca92a002f3565dfd49b5adace195fc825f7180b790a673a7a8f65108aa4936c2b0bc8d76cf822f853da189061d196ddcbd92e6ed26826408bbb1cfa5ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63615.exe

Filesize
184KB

MD5
effc55d83c3d65eda4f926a807a67e76

SHA1
5ea5481e417a3896260145c5897a4912aa56fefe

SHA256
695eb09b894522bc71b3570f481540ff3d6ad68fd2f05140a0f93a35fbdeaf4a

SHA512
e3d4418e819801d6a2c78b6dd73ec9cc6814baba5c91b7772730501e5fc30bf131cf0435bbc2a790e254470b576aadb6bf10068f7dc2d66845d3340016012d3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6906.exe

Filesize
184KB

MD5
4a3012da8fb2e5fcda266e55fe93b223

SHA1
f1e256b194dbb6666098aee456717b293db78ad6

SHA256
bf0e7c50a6aef5ad4fff2dc057d806c982c366bc969eb30ea94589012f2dc1c6

SHA512
fc12dd7f8db1ad38b2d28bf0768b2594711f7a0831db90248503147c9af4623e448999daf321b6df52d0627f43e83ed709d7b8170407dc039fbe19f7108873ee

Download Submit
memory/3576-3358-0x00007FF978510000-0x00007FF978705000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads