cea21cee5e3c3b99d1bec7909df1ab254efe04cb58a412ab18b4cf74c065f9c6

Analysis

max time kernel
120s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2024, 21:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cea21cee5e3c3b99d1bec7909df1ab254efe04cb58a412ab18b4cf74c065f9c6N.exe
Size

468KB
MD5

c421468a0d66230d3e7c4c4728c65b50
SHA1

63fb046e993a69c945bb8cc386fbefca47a216a6
SHA256

cea21cee5e3c3b99d1bec7909df1ab254efe04cb58a412ab18b4cf74c065f9c6
SHA512

48b5c70b02a5515b9b1f0fc7589885243b12d2424ec60665a99ffedb7403ee55a024209ac9f660767e4e53ca17191b2f1322b03b52e0ff0359418b291a415ad8
SSDEEP

3072:1hunogIuIw5UrbYXHzcjrf8/EoOC3lpC6FH0pVCQwaRkiC8zFXe3:1hGo3gUr4H4jrfkj+7waWJ8zF

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2540	Unicorn-59443.exe
2500	Unicorn-21569.exe
4180	Unicorn-36513.exe
2840	Unicorn-51309.exe
2124	Unicorn-37587.exe
1692	Unicorn-23851.exe
4512	Unicorn-63322.exe
1172	Unicorn-30479.exe
4168	Unicorn-37255.exe
3884	Unicorn-48688.exe
4524	Unicorn-48953.exe
4580	Unicorn-53037.exe
3660	Unicorn-34462.exe
2584	Unicorn-3042.exe
1560	Unicorn-19470.exe
1792	Unicorn-53997.exe
3988	Unicorn-22455.exe
2904	Unicorn-38237.exe
2812	Unicorn-25985.exe
3528	Unicorn-2035.exe
4076	Unicorn-15770.exe
872	Unicorn-13540.exe
2016	Unicorn-27168.exe
2220	Unicorn-35834.exe
1256	Unicorn-16233.exe
1448	Unicorn-28699.exe
820	Unicorn-16447.exe
3680	Unicorn-55076.exe
768	Unicorn-18947.exe
2680	Unicorn-25553.exe
2052	Unicorn-27521.exe
1392	Unicorn-3571.exe
64	Unicorn-8946.exe
2024	Unicorn-33551.exe
2012	Unicorn-60193.exe
692	Unicorn-9601.exe
4396	Unicorn-56109.exe
4864	Unicorn-47179.exe
1040	Unicorn-686.exe
2864	Unicorn-686.exe
3564	Unicorn-50442.exe
1552	Unicorn-4770.exe
3324	Unicorn-4770.exe
2368	Unicorn-19161.exe
3896	Unicorn-34105.exe
4668	Unicorn-47841.exe
4812	Unicorn-28505.exe
2976	Unicorn-4670.exe
3960	Unicorn-45346.exe
400	Unicorn-9202.exe
1480	Unicorn-63063.exe
3828	Unicorn-1610.exe
452	Unicorn-24169.exe
4344	Unicorn-39113.exe
736	Unicorn-9870.exe
4544	Unicorn-7070.exe
3760	Unicorn-28152.exe
2512	Unicorn-44589.exe
3240	Unicorn-26014.exe
3832	Unicorn-55087.exe
1064	Unicorn-2378.exe
368	Unicorn-35797.exe
2032	Unicorn-55663.exe
4612	Unicorn-55663.exe

Program crash 8 IoCs

pid	pid_target	Process	procid_target
10156	5688	WerFault.exe	204
10236	5660	WerFault.exe	203
10444	5688	WerFault.exe	204
11544	10344	WerFault.exe	475
11304	5660	WerFault.exe	203
15068	7488	WerFault.exe	305
17340	7488	WerFault.exe	305
17168	15932	WerFault.exe	782

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64542.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5996.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4838.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63774.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3675.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60967.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7230.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3457.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2409.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4341.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41775.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6529.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13634.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45321.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46010.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48953.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-984.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49882.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59202.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25529.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31744.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45626.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36847.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30981.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37438.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3664.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33467.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6710.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10177.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41967.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46317.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31481.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18729.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11049.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3799.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49955.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51802.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51802.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43731.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11669.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7370.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22107.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18082.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9918.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16025.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12456.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9202.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31870.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33701.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61667.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51682.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11662.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45346.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30447.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24681.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59140.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60381.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17420	dwm.exe
Token: SeChangeNotifyPrivilege	17420	dwm.exe
Token: 33	17420	dwm.exe
Token: SeIncBasePriorityPrivilege	17420	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2080	cea21cee5e3c3b99d1bec7909df1ab254efe04cb58a412ab18b4cf74c065f9c6N.exe
2540	Unicorn-59443.exe
2500	Unicorn-21569.exe
4180	Unicorn-36513.exe
2840	Unicorn-51309.exe
2124	Unicorn-37587.exe
1692	Unicorn-23851.exe
4512	Unicorn-63322.exe
1172	Unicorn-30479.exe
4168	Unicorn-37255.exe
4524	Unicorn-48953.exe
4580	Unicorn-53037.exe
3660	Unicorn-34462.exe
3884	Unicorn-48688.exe
2584	Unicorn-3042.exe
1560	Unicorn-19470.exe
3988	Unicorn-22455.exe
2904	Unicorn-38237.exe
872	Unicorn-13540.exe
2812	Unicorn-25985.exe
2016	Unicorn-27168.exe
4076	Unicorn-15770.exe
3528	Unicorn-2035.exe
2220	Unicorn-35834.exe
1256	Unicorn-16233.exe
1448	Unicorn-28699.exe
820	Unicorn-16447.exe
3680	Unicorn-55076.exe
768	Unicorn-18947.exe
2680	Unicorn-25553.exe
2052	Unicorn-27521.exe
4796	Unicorn-62331.exe
1392	Unicorn-3571.exe
64	Unicorn-8946.exe
2024	Unicorn-33551.exe
2012	Unicorn-60193.exe
692	Unicorn-9601.exe
4396	Unicorn-56109.exe
4864	Unicorn-47179.exe
2864	Unicorn-686.exe
4668	Unicorn-47841.exe
3564	Unicorn-50442.exe
1040	Unicorn-686.exe
2368	Unicorn-19161.exe
1552	Unicorn-4770.exe
4812	Unicorn-28505.exe
2976	Unicorn-4670.exe
3896	Unicorn-34105.exe
3960	Unicorn-45346.exe
3324	Unicorn-4770.exe
3828	Unicorn-1610.exe
736	Unicorn-9870.exe
4544	Unicorn-7070.exe
400	Unicorn-9202.exe
452	Unicorn-24169.exe
4344	Unicorn-39113.exe
1480	Unicorn-63063.exe
3760	Unicorn-28152.exe
2512	Unicorn-44589.exe
3240	Unicorn-26014.exe
3832	Unicorn-55087.exe
368	Unicorn-35797.exe
2032	Unicorn-55663.exe
1064	Unicorn-2378.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2540	2080	cea21cee5e3c3b99d1bec7909df1ab254efe04cb58a412ab18b4cf74c065f9c6N.exe	91
PID 2080 wrote to memory of 2540	2080	cea21cee5e3c3b99d1bec7909df1ab254efe04cb58a412ab18b4cf74c065f9c6N.exe	91
PID 2080 wrote to memory of 2540	2080	cea21cee5e3c3b99d1bec7909df1ab254efe04cb58a412ab18b4cf74c065f9c6N.exe	91
PID 2540 wrote to memory of 2500	2540	Unicorn-59443.exe	93
PID 2540 wrote to memory of 2500	2540	Unicorn-59443.exe	93
PID 2540 wrote to memory of 2500	2540	Unicorn-59443.exe	93
PID 2080 wrote to memory of 4180	2080	cea21cee5e3c3b99d1bec7909df1ab254efe04cb58a412ab18b4cf74c065f9c6N.exe	94
PID 2080 wrote to memory of 4180	2080	cea21cee5e3c3b99d1bec7909df1ab254efe04cb58a412ab18b4cf74c065f9c6N.exe	94
PID 2080 wrote to memory of 4180	2080	cea21cee5e3c3b99d1bec7909df1ab254efe04cb58a412ab18b4cf74c065f9c6N.exe	94
PID 2500 wrote to memory of 2840	2500	Unicorn-21569.exe	96
PID 2500 wrote to memory of 2840	2500	Unicorn-21569.exe	96
PID 2500 wrote to memory of 2840	2500	Unicorn-21569.exe	96
PID 2080 wrote to memory of 2124	2080	cea21cee5e3c3b99d1bec7909df1ab254efe04cb58a412ab18b4cf74c065f9c6N.exe	97
PID 2080 wrote to memory of 2124	2080	cea21cee5e3c3b99d1bec7909df1ab254efe04cb58a412ab18b4cf74c065f9c6N.exe	97
PID 2080 wrote to memory of 2124	2080	cea21cee5e3c3b99d1bec7909df1ab254efe04cb58a412ab18b4cf74c065f9c6N.exe	97
PID 2540 wrote to memory of 1692	2540	Unicorn-59443.exe	98
PID 2540 wrote to memory of 1692	2540	Unicorn-59443.exe	98
PID 2540 wrote to memory of 1692	2540	Unicorn-59443.exe	98
PID 4180 wrote to memory of 4512	4180	Unicorn-36513.exe	100
PID 4180 wrote to memory of 4512	4180	Unicorn-36513.exe	100
PID 4180 wrote to memory of 4512	4180	Unicorn-36513.exe	100
PID 2840 wrote to memory of 1172	2840	Unicorn-51309.exe	101
PID 2840 wrote to memory of 1172	2840	Unicorn-51309.exe	101
PID 2840 wrote to memory of 1172	2840	Unicorn-51309.exe	101
PID 2500 wrote to memory of 4168	2500	Unicorn-21569.exe	102
PID 2500 wrote to memory of 4168	2500	Unicorn-21569.exe	102
PID 2500 wrote to memory of 4168	2500	Unicorn-21569.exe	102
PID 2080 wrote to memory of 3884	2080	cea21cee5e3c3b99d1bec7909df1ab254efe04cb58a412ab18b4cf74c065f9c6N.exe	103
PID 2080 wrote to memory of 3884	2080	cea21cee5e3c3b99d1bec7909df1ab254efe04cb58a412ab18b4cf74c065f9c6N.exe	103
PID 2080 wrote to memory of 3884	2080	cea21cee5e3c3b99d1bec7909df1ab254efe04cb58a412ab18b4cf74c065f9c6N.exe	103
PID 2124 wrote to memory of 4524	2124	Unicorn-37587.exe	104
PID 2124 wrote to memory of 4524	2124	Unicorn-37587.exe	104
PID 2124 wrote to memory of 4524	2124	Unicorn-37587.exe	104
PID 1692 wrote to memory of 4580	1692	Unicorn-23851.exe	105
PID 1692 wrote to memory of 4580	1692	Unicorn-23851.exe	105
PID 1692 wrote to memory of 4580	1692	Unicorn-23851.exe	105
PID 2540 wrote to memory of 3660	2540	Unicorn-59443.exe	106
PID 2540 wrote to memory of 3660	2540	Unicorn-59443.exe	106
PID 2540 wrote to memory of 3660	2540	Unicorn-59443.exe	106
PID 4512 wrote to memory of 2584	4512	Unicorn-63322.exe	107
PID 4512 wrote to memory of 2584	4512	Unicorn-63322.exe	107
PID 4512 wrote to memory of 2584	4512	Unicorn-63322.exe	107
PID 4180 wrote to memory of 1560	4180	Unicorn-36513.exe	108
PID 4180 wrote to memory of 1560	4180	Unicorn-36513.exe	108
PID 4180 wrote to memory of 1560	4180	Unicorn-36513.exe	108
PID 1172 wrote to memory of 1792	1172	Unicorn-30479.exe	109
PID 1172 wrote to memory of 1792	1172	Unicorn-30479.exe	109
PID 1172 wrote to memory of 1792	1172	Unicorn-30479.exe	109
PID 2840 wrote to memory of 3988	2840	Unicorn-51309.exe	110
PID 2840 wrote to memory of 3988	2840	Unicorn-51309.exe	110
PID 2840 wrote to memory of 3988	2840	Unicorn-51309.exe	110
PID 4580 wrote to memory of 2904	4580	Unicorn-53037.exe	111
PID 4580 wrote to memory of 2904	4580	Unicorn-53037.exe	111
PID 4580 wrote to memory of 2904	4580	Unicorn-53037.exe	111
PID 4168 wrote to memory of 2812	4168	Unicorn-37255.exe	112
PID 4168 wrote to memory of 2812	4168	Unicorn-37255.exe	112
PID 4168 wrote to memory of 2812	4168	Unicorn-37255.exe	112
PID 1692 wrote to memory of 3528	1692	Unicorn-23851.exe	114
PID 1692 wrote to memory of 3528	1692	Unicorn-23851.exe	114
PID 1692 wrote to memory of 3528	1692	Unicorn-23851.exe	114
PID 2500 wrote to memory of 4076	2500	Unicorn-21569.exe	113
PID 2500 wrote to memory of 4076	2500	Unicorn-21569.exe	113
PID 2500 wrote to memory of 4076	2500	Unicorn-21569.exe	113
PID 4524 wrote to memory of 872	4524	Unicorn-48953.exe	115

C:\Users\Admin\AppData\Local\Temp\cea21cee5e3c3b99d1bec7909df1ab254efe04cb58a412ab18b4cf74c065f9c6N.exe
"C:\Users\Admin\AppData\Local\Temp\cea21cee5e3c3b99d1bec7909df1ab254efe04cb58a412ab18b4cf74c065f9c6N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59443.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59443.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21569.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21569.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51309.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30479.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53997.exe
        6⤵
        Executes dropped EXE
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62331.exe
        7⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2378.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46317.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7142.exe
        10⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30713.exe
        11⤵
        
        PID:13660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11330.exe
        11⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49264.exe
        11⤵
        
        PID:18364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62274.exe
        10⤵
        
        PID:9868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63067.exe
        10⤵
        
        PID:14044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21724.exe
        10⤵
        
        PID:17664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27323.exe
        9⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15672.exe
        9⤵
        
        PID:11940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2409.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:15540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe
        9⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53670.exe
        8⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23323.exe
        9⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13342.exe
        9⤵
        
        PID:11344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14661.exe
        9⤵
        
        PID:15416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11653.exe
        9⤵
        
        PID:18356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1204.exe
        8⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62295.exe
        9⤵
        
        PID:10500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39601.exe
        9⤵
        
        PID:14720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3799.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:17956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59508.exe
        8⤵
        
        PID:11020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53661.exe
        8⤵
        
        PID:14860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26674.exe
        8⤵
        
        PID:14944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47858.exe
        7⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42809.exe
        8⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30723.exe
        9⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30355.exe
        10⤵
        
        PID:11672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60598.exe
        10⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31173.exe
        10⤵
        
        PID:9048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14059.exe
        9⤵
        
        PID:9992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51609.exe
        9⤵
        
        PID:13968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25529.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1859.exe
        8⤵
        
        PID:8020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2918.exe
        9⤵
        
        PID:13012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31371.exe
        9⤵
        
        PID:17020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51402.exe
        9⤵
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30090.exe
        8⤵
        
        PID:11656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5996.exe
        8⤵
        
        PID:15424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56571.exe
        8⤵
        
        PID:18340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60005.exe
        7⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38995.exe
        8⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40805.exe
        8⤵
        
        PID:12364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11256.exe
        8⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36847.exe
        8⤵
        
        PID:18136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17349.exe
        7⤵
        
        PID:8792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29303.exe
        7⤵
        
        PID:14424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7243.exe
        7⤵
        
        PID:1968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3571.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55663.exe
        7⤵
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46099.exe
        8⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11226.exe
        9⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49955.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:14484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35782.exe
        10⤵
        
        PID:14644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23379.exe
        9⤵
        
        PID:10140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53337.exe
        9⤵
        
        PID:14784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65087.exe
        9⤵
        
        PID:17776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27323.exe
        8⤵
        
        PID:8008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15672.exe
        8⤵
        
        PID:11956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2409.exe
        8⤵
        
        PID:15516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38103.exe
        8⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49752.exe
        7⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59135.exe
        8⤵
        
        PID:11540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59576.exe
        8⤵
        
        PID:16224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64100.exe
        8⤵
        
        PID:7720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32070.exe
        7⤵
        
        PID:9872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26748.exe
        7⤵
        
        PID:13952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56057.exe
        7⤵
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61593.exe
        6⤵
        
        PID:856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25103.exe
        7⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50043.exe
        8⤵
        
        PID:10936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31433.exe
        8⤵
        
        PID:14476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3799.exe
        8⤵
        
        PID:17948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18937.exe
        7⤵
        
        PID:8924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62517.exe
        7⤵
        
        PID:12660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40754.exe
        7⤵
        
        PID:13372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3002.exe
        7⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36788.exe
        7⤵
        
        PID:17488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42518.exe
        6⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21803.exe
        7⤵
        
        PID:11932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48346.exe
        7⤵
        
        PID:15556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4147.exe
        7⤵
        
        PID:7908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59997.exe
        6⤵
        
        PID:9836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40633.exe
        6⤵
        
        PID:13876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64985.exe
        6⤵
        
        PID:16688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55841.exe
        6⤵
        
        PID:17880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22455.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27521.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55087.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62269.exe
        8⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48237.exe
        9⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51351.exe
        10⤵
        
        PID:440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41407.exe
        10⤵
        
        PID:16460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22841.exe
        10⤵
        
        PID:17892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23676.exe
        9⤵
        
        PID:11784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5996.exe
        9⤵
        
        PID:15276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11646.exe
        9⤵
        
        PID:18148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56166.exe
        8⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63665.exe
        9⤵
        
        PID:9360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38117.exe
        9⤵
        
        PID:15620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16426.exe
        9⤵
        
        PID:9068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30316.exe
        8⤵
        
        PID:10428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39576.exe
        8⤵
        
        PID:13900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57076.exe
        8⤵
        
        PID:15052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32834.exe
        8⤵
        
        PID:19336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64962.exe
        7⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50759.exe
        8⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16323.exe
        9⤵
        
        PID:13620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43213.exe
        9⤵
        
        PID:15064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8615.exe
        9⤵
        
        PID:18800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2496.exe
        8⤵
        
        PID:11104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65040.exe
        8⤵
        
        PID:15008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43210.exe
        8⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53949.exe
        7⤵
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23339.exe
        8⤵
        
        PID:12884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62098.exe
        8⤵
        
        PID:17060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12891.exe
        8⤵
        
        PID:18188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61070.exe
        7⤵
        
        PID:10660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33432.exe
        7⤵
        
        PID:14568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11708.exe
        7⤵
        
        PID:7076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35797.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42809.exe
        7⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18471.exe
        8⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6426.exe
        9⤵
        
        PID:12268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51216.exe
        9⤵
        
        PID:15980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6093.exe
        9⤵
        
        PID:19292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44786.exe
        8⤵
        
        PID:10004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51609.exe
        8⤵
        
        PID:14328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31481.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1859.exe
        7⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23339.exe
        8⤵
        
        PID:12876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62098.exe
        8⤵
        
        PID:17068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24567.exe
        8⤵
        
        PID:19168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43529.exe
        7⤵
        
        PID:10824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-158.exe
        7⤵
        
        PID:14000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56763.exe
        7⤵
        
        PID:18904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60005.exe
        6⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57059.exe
        7⤵
        
        PID:9720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58294.exe
        7⤵
        
        PID:14212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45845.exe
        7⤵
        
        PID:8132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17349.exe
        6⤵
        
        PID:8800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3910.exe
        6⤵
        
        PID:12336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25387.exe
        6⤵
        
        PID:16452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14705.exe
        6⤵
        
        PID:17876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8946.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:64
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55663.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26473.exe
        7⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23323.exe
        8⤵
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32187.exe
        9⤵
        
        PID:15940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50941.exe
        9⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23187.exe
        8⤵
        
        PID:10640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36233.exe
        8⤵
        
        PID:14556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55383.exe
        8⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30447.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28409.exe
        8⤵
        
        PID:11480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59576.exe
        8⤵
        
        PID:16184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8231.exe
        8⤵
        
        PID:18576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53643.exe
        7⤵
        
        PID:11156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60764.exe
        7⤵
        
        PID:15072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39126.exe
        7⤵
        
        PID:17476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22943.exe
        6⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43551.exe
        7⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64677.exe
        8⤵
        
        PID:8872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64542.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53083.exe
        8⤵
        
        PID:15876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43899.exe
        8⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26119.exe
        7⤵
        
        PID:9416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4162.exe
        7⤵
        
        PID:13352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42826.exe
        7⤵
        
        PID:5300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34068.exe
        6⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9996.exe
        7⤵
        
        PID:9624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14442.exe
        7⤵
        
        PID:13896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50697.exe
        7⤵
        
        PID:17856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49394.exe
        6⤵
        
        PID:10808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43355.exe
        6⤵
        
        PID:14912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26674.exe
        6⤵
        
        PID:7084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1921.exe
        5⤵
        
        PID:3596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16359.exe
        6⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48341.exe
        7⤵
        
        PID:8912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41019.exe
        8⤵
        
        PID:13416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57604.exe
        8⤵
        
        PID:16888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21313.exe
        8⤵
        
        PID:17616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24277.exe
        7⤵
        
        PID:12508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1744.exe
        7⤵
        
        PID:16408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40739.exe
        7⤵
        
        PID:18876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40727.exe
        6⤵
        
        PID:8728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6710.exe
        6⤵
        
        PID:6356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50588.exe
        6⤵
        
        PID:16476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32073.exe
        6⤵
        
        PID:18604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55643.exe
        5⤵
        
        PID:6984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63665.exe
        6⤵
        
        PID:9608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38117.exe
        6⤵
        
        PID:15628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32571.exe
        6⤵
        
        PID:18776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45215.exe
        5⤵
        
        PID:9320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26589.exe
        5⤵
        
        PID:10752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14928.exe
        5⤵
        
        PID:6968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37255.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25985.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33551.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16577.exe
        7⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57583.exe
        8⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11226.exe
        9⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51351.exe
        10⤵
        
        PID:11856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24573.exe
        10⤵
        
        PID:15676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10369.exe
        10⤵
        
        PID:18420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3535.exe
        9⤵
        
        PID:10856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45169.exe
        9⤵
        
        PID:14468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34361.exe
        9⤵
        
        PID:17744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45798.exe
        8⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15672.exe
        8⤵
        
        PID:11948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2409.exe
        8⤵
        
        PID:15524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24097.exe
        8⤵
        
        PID:18116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34209.exe
        7⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11584.exe
        8⤵
        
        PID:8632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31870.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60463.exe
        8⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61645.exe
        7⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5175.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14102.exe
        7⤵
        
        PID:16396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35958.exe
        7⤵
        
        PID:18504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33467.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10904.exe
        7⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11584.exe
        8⤵
        
        PID:8640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42673.exe
        8⤵
        
        PID:13192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15223.exe
        8⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12715.exe
        7⤵
        
        PID:8860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12740.exe
        7⤵
        
        PID:12432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8264.exe
        7⤵
        
        PID:17148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19300.exe
        7⤵
        
        PID:14596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30238.exe
        6⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17885.exe
        7⤵
        
        PID:13104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52560.exe
        7⤵
        
        PID:17184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8231.exe
        7⤵
        
        PID:18260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37936.exe
        6⤵
        
        PID:9820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57169.exe
        6⤵
        
        PID:13860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36174.exe
        6⤵
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9601.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51771.exe
        6⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54651.exe
        7⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17413.exe
        8⤵
        
        PID:15888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34158.exe
        8⤵
        
        PID:19384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51802.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61339.exe
        7⤵
        
        PID:12648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58154.exe
        7⤵
        
        PID:16884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5109.exe
        7⤵
        
        PID:6192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41967.exe
        6⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56421.exe
        7⤵
        
        PID:11404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60598.exe
        7⤵
        
        PID:15368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22813.exe
        7⤵
        
        PID:18428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59097.exe
        6⤵
        
        PID:9348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55336.exe
        6⤵
        
        PID:14168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15024.exe
        6⤵
        
        PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35911.exe
        5⤵
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24693.exe
        6⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23401.exe
        7⤵
        
        PID:10780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-707.exe
        7⤵
        
        PID:14376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44832.exe
        7⤵
        
        PID:17868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49062.exe
        6⤵
        
        PID:9924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51609.exe
        6⤵
        
        PID:13976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39536.exe
        6⤵
        
        PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49124.exe
        5⤵
        
        PID:7612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27516.exe
        5⤵
        
        PID:10360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30711.exe
        5⤵
        
        PID:13828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42396.exe
        5⤵
        
        PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15770.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19161.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12876.exe
        6⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16935.exe
        7⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-126.exe
        8⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1937.exe
        8⤵
        
        PID:11924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55440.exe
        8⤵
        
        PID:16736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28181.exe
        8⤵
        
        PID:18168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49088.exe
        7⤵
        
        PID:8680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6710.exe
        7⤵
        
        PID:11088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50588.exe
        7⤵
        
        PID:16484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31725.exe
        7⤵
        
        PID:18048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24863.exe
        6⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23339.exe
        7⤵
        
        PID:12920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62098.exe
        7⤵
        
        PID:17116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12891.exe
        7⤵
        
        PID:17988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32070.exe
        6⤵
        
        PID:9860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26748.exe
        6⤵
        
        PID:13928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31744.exe
        6⤵
        
        PID:6212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11869.exe
        5⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19649.exe
        6⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63665.exe
        7⤵
        
        PID:9528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47386.exe
        7⤵
        
        PID:15176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46010.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64438.exe
        6⤵
        
        PID:8868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28282.exe
        6⤵
        
        PID:12408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21781.exe
        6⤵
        
        PID:17216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61300.exe
        6⤵
        
        PID:7700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49673.exe
        5⤵
        
        PID:7208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56945.exe
        6⤵
        
        PID:15284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41402.exe
        6⤵
        
        PID:17732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64962.exe
        5⤵
        
        PID:9232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46671.exe
        5⤵
        
        PID:14192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48810.exe
        5⤵
        
        PID:13760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45346.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33297.exe
        5⤵
        
        PID:4244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11672.exe
        6⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30499.exe
        7⤵
        
        PID:12100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40037.exe
        7⤵
        
        PID:16492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46769.exe
        7⤵
        
        PID:9136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51802.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61339.exe
        6⤵
        
        PID:12676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58154.exe
        6⤵
        
        PID:16856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14175.exe
        6⤵
        
        PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41967.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41621.exe
        6⤵
        
        PID:12448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39347.exe
        6⤵
        
        PID:15500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2585.exe
        6⤵
        
        PID:7372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59097.exe
        5⤵
        
        PID:9240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55336.exe
        5⤵
        
        PID:14176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10748.exe
        5⤵
        
        PID:2340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63837.exe
      4⤵
      PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21725.exe
        5⤵
        
        PID:8012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2342.exe
        6⤵
        
        PID:9316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41407.exe
        6⤵
        
        PID:16508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51237.exe
        6⤵
        
        PID:9032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21625.exe
        5⤵
        
        PID:10892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46155.exe
        5⤵
        
        PID:14868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31455.exe
        5⤵
        
        PID:6568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51682.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49967.exe
      4⤵
      PID:11580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50532.exe
      4⤵
      PID:15464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53376.exe
      4⤵
      PID:17772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23851.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23851.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53037.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38237.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56109.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55663.exe
        7⤵
        Executes dropped EXE
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20251.exe
        8⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2840.exe
        9⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38885.exe
        9⤵
        
        PID:11988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55440.exe
        9⤵
        
        PID:16760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7377.exe
        9⤵
        
        PID:9144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27707.exe
        8⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62295.exe
        9⤵
        
        PID:10456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe
        9⤵
        
        PID:15592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36847.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:18128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14302.exe
        8⤵
        
        PID:12008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2409.exe
        8⤵
        
        PID:15508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9515.exe
        8⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        7⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30635.exe
        8⤵
        
        PID:8880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12217.exe
        8⤵
        
        PID:13300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40037.exe
        8⤵
        
        PID:16672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36847.exe
        8⤵
        
        PID:18156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3316.exe
        7⤵
        
        PID:8832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12575.exe
        7⤵
        
        PID:12312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41923.exe
        7⤵
        
        PID:16664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52487.exe
        7⤵
        
        PID:8160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25491.exe
        6⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49223.exe
        7⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8678.exe
        8⤵
        
        PID:8224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58320.exe
        8⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7774.exe
        8⤵
        
        PID:16212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65305.exe
        8⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30613.exe
        7⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6710.exe
        7⤵
        
        PID:11288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50588.exe
        7⤵
        
        PID:16524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20013.exe
        7⤵
        
        PID:18240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13518.exe
        6⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5274.exe
        7⤵
        
        PID:11320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60598.exe
        7⤵
        
        PID:15440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30981.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18501.exe
        6⤵
        
        PID:8240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56401.exe
        6⤵
        
        PID:12988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36174.exe
        6⤵
        
        PID:5888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50442.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51771.exe
        6⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29763.exe
        7⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35015.exe
        8⤵
        
        PID:10948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57246.exe
        8⤵
        
        PID:15904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49264.exe
        8⤵
        
        PID:18288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26119.exe
        7⤵
        
        PID:9560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63477.exe
        7⤵
        
        PID:13576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31149.exe
        7⤵
        
        PID:6668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11049.exe
        6⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40085.exe
        7⤵
        
        PID:11280
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7488 -s 696
        7⤵
        Program crash
        
        PID:15068
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7488 -s 732
        7⤵
        Program crash
        
        PID:17340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38485.exe
        6⤵
        
        PID:10292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21101.exe
        6⤵
        
        PID:232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4341.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5184.exe
        5⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12440.exe
        6⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57059.exe
        7⤵
        
        PID:9376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58294.exe
        7⤵
        
        PID:14228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43707.exe
        7⤵
        
        PID:7872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23676.exe
        6⤵
        
        PID:11792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5996.exe
        6⤵
        
        PID:4776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52487.exe
        6⤵
        
        PID:6312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21459.exe
        5⤵
        
        PID:7980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50365.exe
        6⤵
        
        PID:11976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63058.exe
        6⤵
        
        PID:1804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34873.exe
        6⤵
        
        PID:19156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32560.exe
        5⤵
        
        PID:10884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26819.exe
        5⤵
        
        PID:14892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35572.exe
        5⤵
        
        PID:6972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2035.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-686.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49249.exe
        6⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32071.exe
        7⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64267.exe
        8⤵
        
        PID:9516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61994.exe
        8⤵
        
        PID:13588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3664.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9664.exe
        8⤵
        
        PID:17916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53285.exe
        7⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5175.exe
        7⤵
        
        PID:13228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14102.exe
        7⤵
        
        PID:16632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11838.exe
        7⤵
        
        PID:18380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3675.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8678.exe
        7⤵
        
        PID:7972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41407.exe
        7⤵
        
        PID:10160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37925.exe
        7⤵
        
        PID:15868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40739.exe
        7⤵
        
        PID:18476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3700.exe
        6⤵
        
        PID:9008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60022.exe
        6⤵
        
        PID:13028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42307.exe
        6⤵
        
        PID:17012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46648.exe
        6⤵
        
        PID:9196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29959.exe
        5⤵
        
        PID:1432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10904.exe
        6⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48341.exe
        7⤵
        
        PID:8904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24277.exe
        7⤵
        
        PID:12500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32135.exe
        7⤵
        
        PID:7332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12715.exe
        6⤵
        
        PID:8852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12740.exe
        6⤵
        
        PID:12424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58948.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23905.exe
        6⤵
        
        PID:18552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5926.exe
        5⤵
        
        PID:7140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25783.exe
        6⤵
        
        PID:8816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19617.exe
        6⤵
        
        PID:12388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53083.exe
        6⤵
        
        PID:15588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26541.exe
        6⤵
        
        PID:18592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45720.exe
        5⤵
        
        PID:9408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26058.exe
        5⤵
        
        PID:10344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54046.exe
        5⤵
        
        PID:8152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47841.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51771.exe
        5⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62819.exe
        6⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57059.exe
        7⤵
        
        PID:9784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54210.exe
        7⤵
        
        PID:14316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25615.exe
        7⤵
        
        PID:1868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45580.exe
        6⤵
        
        PID:8460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25952.exe
        6⤵
        
        PID:13268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17121.exe
        6⤵
        
        PID:16776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17875.exe
        6⤵
        
        PID:18840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44106.exe
        5⤵
        
        PID:7180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18845.exe
        6⤵
        
        PID:14200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54370.exe
        6⤵
        
        PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59097.exe
        5⤵
        
        PID:9272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55336.exe
        5⤵
        
        PID:14184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31744.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11049.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3457.exe
        5⤵
        
        PID:7764
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5660 -s 636
        5⤵
        Program crash
        
        PID:10236
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5660 -s 660
        5⤵
        Program crash
        
        PID:11304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30152.exe
      4⤵
      PID:7412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47049.exe
        5⤵
        
        PID:13528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61578.exe
        5⤵
        
        PID:7512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25371.exe
      4⤵
      PID:9988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41747.exe
      4⤵
      PID:13508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26319.exe
      4⤵
      PID:3244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34462.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34462.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25553.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44589.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46125.exe
        6⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42399.exe
        7⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3416.exe
        8⤵
        
        PID:8688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58512.exe
        8⤵
        
        PID:12356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44723.exe
        8⤵
        
        PID:16500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30433.exe
        8⤵
        
        PID:18636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15621.exe
        7⤵
        
        PID:9024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26528.exe
        7⤵
        
        PID:12660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58154.exe
        7⤵
        
        PID:16948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15929.exe
        7⤵
        
        PID:18208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50136.exe
        6⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59021.exe
        7⤵
        
        PID:16316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57895.exe
        7⤵
        
        PID:18836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59097.exe
        6⤵
        
        PID:9220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55336.exe
        6⤵
        
        PID:14152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11900.exe
        6⤵
        
        PID:17108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5647.exe
        5⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16525.exe
        6⤵
        
        PID:220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23676.exe
        6⤵
        
        PID:11800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5996.exe
        6⤵
        
        PID:13768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7370.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43643.exe
        5⤵
        
        PID:7956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62295.exe
        6⤵
        
        PID:10448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39601.exe
        6⤵
        
        PID:14416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28495.exe
        6⤵
        
        PID:17796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49394.exe
        5⤵
        
        PID:10816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10265.exe
        5⤵
        
        PID:14460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38634.exe
        5⤵
        
        PID:9116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26014.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7230.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56405.exe
        6⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29727.exe
        7⤵
        
        PID:14272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46141.exe
        7⤵
        
        PID:14592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18729.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52762.exe
        6⤵
        
        PID:9472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10192.exe
        6⤵
        
        PID:13544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34849.exe
        6⤵
        
        PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56166.exe
        5⤵
        
        PID:7556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23874.exe
        6⤵
        
        PID:18404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28974.exe
        5⤵
        
        PID:10300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28170.exe
        5⤵
        
        PID:15104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32834.exe
        5⤵
        
        PID:19352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17079.exe
      4⤵
      PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18471.exe
        5⤵
        
        PID:6792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48341.exe
        6⤵
        
        PID:8936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48782.exe
        6⤵
        
        PID:12652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49575.exe
        6⤵
        
        PID:16748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55129.exe
        6⤵
        
        PID:18276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26119.exe
        5⤵
        
        PID:9428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23432.exe
        5⤵
        
        PID:14636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42826.exe
        5⤵
        
        PID:3924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40459.exe
      4⤵
      PID:7628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57059.exe
        5⤵
        
        PID:10312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36311.exe
        5⤵
        
        PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7141.exe
        5⤵
        
        PID:1744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10981.exe
      4⤵
      PID:10368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47777.exe
      4⤵
      PID:13820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9983.exe
      4⤵
      PID:2708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35834.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35834.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60193.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35435.exe
        5⤵
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35409.exe
        6⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33157.exe
        7⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45466.exe
        7⤵
        
        PID:13052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44309.exe
        7⤵
        
        PID:5884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40727.exe
        6⤵
        
        PID:8736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6710.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50588.exe
        6⤵
        
        PID:16440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe
        6⤵
        
        PID:18812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34209.exe
        5⤵
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34143.exe
        6⤵
        
        PID:8708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31870.exe
        6⤵
        
        PID:14008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58517.exe
        6⤵
        
        PID:19192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3125.exe
        5⤵
        
        PID:9844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18082.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47919.exe
        5⤵
        
        PID:16448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26226.exe
        5⤵
        
        PID:17764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52902.exe
      4⤵
      PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3457.exe
        5⤵
        
        PID:7748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39047.exe
        6⤵
        
        PID:14924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27744.exe
        6⤵
        
        PID:18496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36923.exe
        5⤵
        
        PID:10628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44699.exe
        5⤵
        
        PID:14348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7754.exe
        5⤵
        
        PID:18852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3980.exe
      4⤵
      PID:6252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28409.exe
        5⤵
        
        PID:11316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17967.exe
        5⤵
        
        PID:16044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12315.exe
        5⤵
        
        PID:18620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64962.exe
      4⤵
      PID:8284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46671.exe
      4⤵
      PID:14144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48618.exe
      4⤵
      PID:6124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47179.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47179.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12492.exe
      4⤵
      PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59145.exe
        5⤵
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
        6⤵
        
        PID:7604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18849.exe
        6⤵
        
        PID:12256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37925.exe
        6⤵
        
        PID:15956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24403.exe
        6⤵
        
        PID:18760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34505.exe
        5⤵
        
        PID:8256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6518.exe
        5⤵
        
        PID:11576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13639.exe
        5⤵
        
        PID:15432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48472.exe
        5⤵
        
        PID:7508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
      4⤵
      PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59135.exe
        5⤵
        
        PID:11468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59576.exe
        5⤵
        
        PID:16200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3441.exe
        5⤵
        
        PID:6028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11484.exe
      4⤵
      PID:8776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34133.exe
        5⤵
        
        PID:14028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41558.exe
        5⤵
        
        PID:18436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12575.exe
      4⤵
      PID:12348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41923.exe
      4⤵
      PID:16464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38288.exe
      4⤵
      PID:18264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23783.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23783.exe
    3⤵
    PID:1212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61667.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38253.exe
        5⤵
        
        PID:7348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57552.exe
        5⤵
        
        PID:11612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8796.exe
        5⤵
        
        PID:15404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16234.exe
        5⤵
        
        PID:18384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46182.exe
      4⤵
      PID:8188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11972.exe
      4⤵
      PID:10908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45736.exe
      4⤵
      PID:16140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10091.exe
      4⤵
      PID:18296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21170.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21170.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57059.exe
      4⤵
      PID:9808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31651.exe
      4⤵
      PID:14264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47407.exe
      4⤵
      PID:7796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-896.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-896.exe
    3⤵
    PID:9080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9261.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9261.exe
    3⤵
    PID:13076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41359.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41359.exe
    3⤵
    PID:17176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23043.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23043.exe
    3⤵
    PID:17740
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36513.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36513.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63322.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63322.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3042.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16447.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9202.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29789.exe
        7⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3457.exe
        8⤵
        
        PID:7940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39445.exe
        8⤵
        
        PID:10788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56104.exe
        8⤵
        
        PID:14768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4507.exe
        8⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44106.exe
        7⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20407.exe
        8⤵
        
        PID:13492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61578.exe
        8⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59097.exe
        7⤵
        
        PID:9276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55336.exe
        7⤵
        
        PID:14160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13308.exe
        7⤵
        
        PID:16880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50001.exe
        7⤵
        
        PID:17904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27552.exe
        6⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26333.exe
        7⤵
        
        PID:9292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35735.exe
        7⤵
        
        PID:14092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13390.exe
        7⤵
        
        PID:6048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22088.exe
        6⤵
        
        PID:8932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39865.exe
        6⤵
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13646.exe
        6⤵
        
        PID:17328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13849.exe
        6⤵
        
        PID:7912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54001.exe
        5⤵
        
        PID:1908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50785.exe
        6⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-510.exe
        7⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4956.exe
        7⤵
        
        PID:12896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50972.exe
        7⤵
        
        PID:17052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20013.exe
        7⤵
        
        PID:18408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59394.exe
        6⤵
        
        PID:8532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-680.exe
        6⤵
        
        PID:12284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59140.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52494.exe
        6⤵
        
        PID:18216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53234.exe
        5⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18165.exe
        6⤵
        
        PID:9156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34365.exe
        6⤵
        
        PID:13364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7333.exe
        6⤵
        
        PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41549.exe
        5⤵
        
        PID:8596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52912.exe
        5⤵
        
        PID:12248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42453.exe
        5⤵
        
        PID:16308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21187.exe
        5⤵
        
        PID:18668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18947.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1610.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25705.exe
        6⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65533.exe
        7⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23121.exe
        8⤵
        
        PID:13692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40774.exe
        8⤵
        
        PID:14932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52170.exe
        8⤵
        
        PID:19324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23676.exe
        7⤵
        
        PID:11816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5996.exe
        7⤵
        
        PID:15380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61039.exe
        7⤵
        
        PID:18056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41775.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28855.exe
        7⤵
        
        PID:9340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47386.exe
        7⤵
        
        PID:15168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17421.exe
        7⤵
        
        PID:6588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        6⤵
        
        PID:10064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49882.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22815.exe
        6⤵
        
        PID:3068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63016.exe
        5⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3457.exe
        6⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24901.exe
        7⤵
        
        PID:11644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28849.exe
        7⤵
        
        PID:16372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25589.exe
        7⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35361.exe
        6⤵
        
        PID:10868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52020.exe
        6⤵
        
        PID:14876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43210.exe
        6⤵
        
        PID:7024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43259.exe
        5⤵
        
        PID:7636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55243.exe
        6⤵
        
        PID:12080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48886.exe
        6⤵
        
        PID:15972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45626.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36182.exe
        5⤵
        
        PID:10384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30910.exe
        5⤵
        
        PID:14988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57401.exe
        5⤵
        
        PID:6912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9870.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40095.exe
        5⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-188.exe
        6⤵
        
        PID:7472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2191.exe
        6⤵
        
        PID:10248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27680.exe
        6⤵
        
        PID:13792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32057.exe
        6⤵
        
        PID:5212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28885.exe
        5⤵
        
        PID:7884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57059.exe
        6⤵
        
        PID:9752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31651.exe
        6⤵
        
        PID:14256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58097.exe
        6⤵
        
        PID:8156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10472.exe
        5⤵
        
        PID:10636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59202.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-999.exe
        5⤵
        
        PID:17936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9566.exe
      4⤵
      PID:4108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58408.exe
        5⤵
        
        PID:908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59201.exe
        5⤵
        
        PID:12904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33697.exe
        5⤵
        
        PID:14852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59824.exe
      4⤵
      PID:8560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4440.exe
      4⤵
      PID:12292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20922.exe
      4⤵
      PID:16512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11768.exe
      4⤵
      PID:9132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19470.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19470.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28699.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24169.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21621.exe
        6⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1750.exe
        7⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12217.exe
        8⤵
        
        PID:13292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11256.exe
        8⤵
        
        PID:16892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4838.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49062.exe
        7⤵
        
        PID:9956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51609.exe
        7⤵
        
        PID:13984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29421.exe
        7⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27464.exe
        6⤵
        
        PID:8208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49405.exe
        7⤵
        
        PID:12276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51216.exe
        7⤵
        
        PID:15912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20675.exe
        7⤵
        
        PID:3352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9172.exe
        6⤵
        
        PID:11008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49315.exe
        6⤵
        
        PID:15932
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15932 -s 464
        7⤵
        Program crash
        
        PID:17168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42910.exe
        6⤵
        
        PID:18396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12366.exe
        5⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62295.exe
        6⤵
        
        PID:10464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe
        6⤵
        
        PID:15600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10012.exe
        6⤵
        
        PID:1280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42701.exe
        5⤵
        
        PID:2088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39865.exe
        5⤵
        
        PID:12932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14643.exe
        5⤵
        
        PID:6036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39113.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35819.exe
        5⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3120.exe
        6⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18383.exe
        7⤵
        
        PID:8696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40805.exe
        7⤵
        
        PID:12304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11256.exe
        7⤵
        
        PID:16864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27973.exe
        7⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17375.exe
        6⤵
        
        PID:8476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59009.exe
        6⤵
        
        PID:12540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42442.exe
        6⤵
        
        PID:6496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55782.exe
        5⤵
        
        PID:6204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38663.exe
        6⤵
        
        PID:15024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41402.exe
        6⤵
        
        PID:17700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59097.exe
        5⤵
        
        PID:9396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55336.exe
        5⤵
        
        PID:14132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13078.exe
        5⤵
        
        PID:5856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41941.exe
      4⤵
      PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30723.exe
        5⤵
        
        PID:6756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57059.exe
        6⤵
        
        PID:8920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48756.exe
        6⤵
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22107.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18335.exe
        5⤵
        
        PID:9948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51609.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30983.exe
        5⤵
        
        PID:4072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38818.exe
      4⤵
      PID:7420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37153.exe
        5⤵
        
        PID:11292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57246.exe
        5⤵
        
        PID:2712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48916.exe
        5⤵
        
        PID:17828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60381.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24681.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35598.exe
      4⤵
      PID:988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55076.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55076.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63063.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7230.exe
        5⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3457.exe
        6⤵
        
        PID:7932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34174.exe
        6⤵
        
        PID:11636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5996.exe
        6⤵
        
        PID:15448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32066.exe
        6⤵
        
        PID:9200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29523.exe
        5⤵
        
        PID:7620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30316.exe
        5⤵
        
        PID:10408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39576.exe
        5⤵
        
        PID:13916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57076.exe
        5⤵
        
        PID:14580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32834.exe
        5⤵
        
        PID:19300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12366.exe
      4⤵
      PID:5636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-126.exe
        5⤵
        
        PID:8092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1937.exe
        5⤵
        
        PID:11916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62081.exe
        5⤵
        
        PID:15576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63489.exe
        5⤵
        
        PID:18252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42701.exe
      4⤵
      PID:8388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39865.exe
      4⤵
      PID:13024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62079.exe
      4⤵
      PID:17164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9381.exe
      4⤵
      PID:5036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7070.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7070.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29789.exe
      4⤵
      PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30723.exe
        5⤵
        
        PID:6924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49597.exe
        6⤵
        
        PID:12680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33701.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4147.exe
        6⤵
        
        PID:7220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23676.exe
        5⤵
        
        PID:11808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5996.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63177.exe
        5⤵
        
        PID:17852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17847.exe
      4⤵
      PID:7672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34400.exe
      4⤵
      PID:10416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39576.exe
      4⤵
      PID:14060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57076.exe
      4⤵
      PID:14644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3862.exe
      4⤵
      PID:18084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57416.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57416.exe
    3⤵
    PID:5760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18471.exe
      4⤵
      PID:7040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44786.exe
      4⤵
      PID:10016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51609.exe
      4⤵
      PID:13944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53516.exe
      4⤵
      PID:7896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30683.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30683.exe
    3⤵
    PID:7400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20906.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20906.exe
    3⤵
    PID:10048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14881.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14881.exe
    3⤵
    PID:1316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-680.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-680.exe
    3⤵
    PID:428
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37587.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37587.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48953.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48953.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13540.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-686.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49825.exe
        6⤵
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-598.exe
        7⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-510.exe
        8⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11662.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44392.exe
        9⤵
        
        PID:17220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10177.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:8964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63774.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
        8⤵
        
        PID:16056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51491.exe
        8⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63286.exe
        7⤵
        
        PID:8784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6710.exe
        7⤵
        
        PID:10976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50588.exe
        7⤵
        
        PID:16432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65322.exe
        7⤵
        
        PID:18460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65320.exe
        6⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61351.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29306.exe
        7⤵
        
        PID:18824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12636.exe
        6⤵
        
        PID:8272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65066.exe
        6⤵
        
        PID:2236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53343.exe
        6⤵
        
        PID:2716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3701.exe
        5⤵
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19649.exe
        6⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34501.exe
        7⤵
        
        PID:9400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58294.exe
        7⤵
        
        PID:14244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5004.exe
        7⤵
        
        PID:6248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64438.exe
        6⤵
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28282.exe
        6⤵
        
        PID:12456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42826.exe
        6⤵
        
        PID:5816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2793.exe
        5⤵
        
        PID:7848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35461.exe
        6⤵
        
        PID:11060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17235.exe
        6⤵
        
        PID:15092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52170.exe
        6⤵
        
        PID:19312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7672.exe
        5⤵
        
        PID:10324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43731.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23127.exe
        5⤵
        
        PID:17628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34105.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8792.exe
        5⤵
        
        PID:5156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8678.exe
        6⤵
        
        PID:8232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58320.exe
        6⤵
        
        PID:11500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7774.exe
        6⤵
        
        PID:15116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47407.exe
        6⤵
        
        PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53582.exe
        5⤵
        
        PID:7384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60967.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12970.exe
        6⤵
        
        PID:18692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52813.exe
        5⤵
        
        PID:11744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14661.exe
        5⤵
        
        PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9515.exe
        5⤵
        
        PID:6544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25604.exe
      4⤵
      PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9918.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23339.exe
        6⤵
        
        PID:12908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62098.exe
        6⤵
        
        PID:17032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24567.exe
        6⤵
        
        PID:18656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49062.exe
        5⤵
        
        PID:9932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20882.exe
        5⤵
        
        PID:13908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7583.exe
        5⤵
        
        PID:2952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37179.exe
        5⤵
        
        PID:7608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6529.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12456.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24573.exe
        5⤵
        
        PID:15608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53540.exe
        5⤵
        
        PID:18220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56489.exe
      4⤵
      PID:10680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4645.exe
      4⤵
      PID:14608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11669.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16233.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16233.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4770.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51771.exe
        5⤵
        
        PID:2476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53691.exe
        6⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42887.exe
        7⤵
        
        PID:8888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24277.exe
        7⤵
        
        PID:12492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1744.exe
        7⤵
        
        PID:16400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63297.exe
        7⤵
        
        PID:18708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4852.exe
        6⤵
        
        PID:9588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2435.exe
        6⤵
        
        PID:13776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12476.exe
        6⤵
        
        PID:7504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44708.exe
        5⤵
        
        PID:6976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
        6⤵
        
        PID:9740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58294.exe
        6⤵
        
        PID:14220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52067.exe
        6⤵
        
        PID:6508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29740.exe
        5⤵
        
        PID:9308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53006.exe
        5⤵
        
        PID:980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3002.exe
        5⤵
        
        PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50001.exe
        5⤵
        
        PID:17896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28702.exe
      4⤵
      PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42311.exe
        5⤵
        
        PID:8660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37438.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3739.exe
        5⤵
        
        PID:1204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19487.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23337.exe
      4⤵
      PID:13096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40709.exe
      4⤵
      PID:5016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4670.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4670.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51771.exe
      4⤵
      PID:5128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59721.exe
        5⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38995.exe
        6⤵
        
        PID:8500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40805.exe
        6⤵
        
        PID:12532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11256.exe
        6⤵
        
        PID:16816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54615.exe
        6⤵
        
        PID:5696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55502.exe
        5⤵
        
        PID:9016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54157.exe
        5⤵
        
        PID:13036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50972.exe
        5⤵
        
        PID:17040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42572.exe
        5⤵
        
        PID:8988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31390.exe
      4⤵
      PID:7784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5336.exe
        5⤵
        
        PID:10084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52264.exe
        5⤵
        
        PID:14032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58891.exe
        5⤵
        
        PID:3980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14626.exe
      4⤵
      PID:11416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54998.exe
      4⤵
      PID:15388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11991.exe
      4⤵
      PID:9176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35554.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35554.exe
    3⤵
    PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60489.exe
      4⤵
      PID:6956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43899.exe
        5⤵
        
        PID:13656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21522.exe
        5⤵
        
        PID:18740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16005.exe
      4⤵
      PID:9328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28858.exe
      4⤵
      PID:5688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57600.exe
      4⤵
      PID:7100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1180.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1180.exe
    3⤵
    PID:6300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14594.exe
      4⤵
      PID:12060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24573.exe
      4⤵
      PID:15832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14261.exe
      4⤵
      PID:17944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39761.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39761.exe
    3⤵
    PID:8384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47201.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47201.exe
    3⤵
    PID:14116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23890.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23890.exe
    3⤵
    PID:5184
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48688.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48688.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28152.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28152.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13452.exe
      4⤵
      PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3457.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45321.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43239.exe
        6⤵
        
        PID:16240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18729.exe
        6⤵
        
        PID:18372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36923.exe
        5⤵
        
        PID:10620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42098.exe
        5⤵
        
        PID:14584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34465.exe
        5⤵
        
        PID:1032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19217.exe
      4⤵
      PID:7428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45015.exe
        5⤵
        
        PID:16096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31890.exe
        5⤵
        
        PID:7664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15926.exe
      4⤵
      PID:9336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33546.exe
      4⤵
      PID:13772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4341.exe
      4⤵
      PID:3468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11049.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11049.exe
    3⤵
    PID:5688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30723.exe
      4⤵
      PID:7164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41403.exe
        5⤵
        
        PID:14288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59135.exe
        5⤵
        
        PID:4424
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5688 -s 652
      4⤵
      Program crash
      PID:10156
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5688 -s 652
      4⤵
      Program crash
      PID:10444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12794.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12794.exe
    3⤵
    PID:8000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44807.exe
      4⤵
      PID:9632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37231.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27168.exe
        5⤵
        
        PID:17516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58294.exe
      4⤵
      PID:14236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61989.exe
      4⤵
      PID:17600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16025.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16025.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:10876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43885.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43885.exe
    3⤵
    PID:14884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30377.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30377.exe
    3⤵
    PID:7324
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27168.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27168.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4770.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4770.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31159.exe
      4⤵
      PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25679.exe
        5⤵
        
        PID:7012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28855.exe
        6⤵
        
        PID:10532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49332.exe
        6⤵
        
        PID:14068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50094.exe
        6⤵
        
        PID:7924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38371.exe
        5⤵
        
        PID:9388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16414.exe
        5⤵
        
        PID:13084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46910.exe
        5⤵
        
        PID:17096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62849.exe
      4⤵
      PID:7572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21153.exe
      4⤵
      PID:11484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53059.exe
      4⤵
      PID:2168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25844.exe
      4⤵
      PID:18300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56986.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56986.exe
    3⤵
    PID:5668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27817.exe
      4⤵
      PID:6808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38995.exe
        5⤵
        
        PID:8824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12217.exe
        5⤵
        
        PID:13284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11256.exe
        5⤵
        
        PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32057.exe
        5⤵
        
        PID:5192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11153.exe
      4⤵
      PID:9004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23048.exe
      4⤵
      PID:14340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3739.exe
      4⤵
      PID:6224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45589.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45589.exe
    3⤵
    PID:7192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21983.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21983.exe
    3⤵
    PID:9364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46671.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46671.exe
    3⤵
    PID:14124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11861.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11861.exe
    3⤵
    PID:5248
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28505.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28505.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51771.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51771.exe
    3⤵
    PID:5144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32477.exe
      4⤵
      PID:3168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13634.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48886.exe
        5⤵
        
        PID:15848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20675.exe
        5⤵
        
        PID:7648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49062.exe
      4⤵
      PID:9940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51609.exe
      4⤵
      PID:13992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19883.exe
      4⤵
      PID:4924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21816.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21816.exe
    3⤵
    PID:1428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24890.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24890.exe
    3⤵
    PID:9976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-158.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-158.exe
    3⤵
    PID:15140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61039.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61039.exe
    3⤵
    PID:18164
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2914.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2914.exe
  2⤵
  PID:5640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63203.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63203.exe
    3⤵
    PID:5824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58408.exe
      4⤵
      PID:3308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27132.exe
      4⤵
      PID:14368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46718.exe
      4⤵
      PID:17348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56462.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56462.exe
    3⤵
    PID:8292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18373.exe
      4⤵
      PID:3628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10676.exe
      4⤵
      PID:17712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10000.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10000.exe
    3⤵
    PID:1220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30983.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30983.exe
    3⤵
    PID:1008
- C:\Users\Admin\AppData\Local\Temp\Unicorn-984.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-984.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12404.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12404.exe
    3⤵
    PID:14744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9078.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9078.exe
    3⤵
    PID:18312
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1181.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1181.exe
  2⤵
  PID:10344
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 10344 -s 464
    3⤵
    - Program crash
    PID:11544
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45723.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45723.exe
  2⤵
  PID:13636
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20007.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20007.exe
  2⤵
  PID:2692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5688 -ip 5688
1⤵
PID:9624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5660 -ip 5660
1⤵
PID:10164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5688 -ip 5688
1⤵
PID:10960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 10344 -ip 10344
1⤵
PID:10904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5660 -ip 5660
1⤵
PID:11852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 7488 -ip 7488
1⤵
PID:15004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 7488 -ip 7488
1⤵
PID:17268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 15932 -ip 15932
1⤵
PID:17100

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-13540.exe

Filesize
468KB

MD5
054054dbea212eb387a05b2271e88d6a

SHA1
7598ddc82eca72dce14596d8509e2e79f16df95c

SHA256
712f5738141c5f08147230319af8e1a4d225cb23431c01ad4cb4575f992568c2

SHA512
53fc1a1241cae978656cef557b65944b20bd2532d1dd09b3036f15aa3d5d1d05a5c6df083f94ea554dfb58581ed90e82fc3c28d52daac92591a10a3c18628801

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15770.exe

Filesize
468KB

MD5
d9c1723d07ab8935d3ccfd0ee3e69bd9

SHA1
7e22b9658351ba87b2ce666c0d5ac237167b9889

SHA256
3df78024087d6de820bf33d1dfcd7bb937e3422e6aa62dbc7db4d5a2b9d00396

SHA512
bbbf3db338f0b971b24e0351019b3496d703f1ce1711677e8b075acba73909b5e78542a39a99a7277f80dea0a6c195df2fb0bb843e1395733a106d0ffdc45e1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16233.exe

Filesize
468KB

MD5
3475b51b82ed31beb9891ec67d5d590d

SHA1
d7f416f6e81158b7ae3622c1d8e6e0b1f66589ff

SHA256
58b8a9797cb3758f20d0ca73b2c40cca446514c07c34e912cc7e4c0506b0870e

SHA512
fccb5e723a2bead4cf6cae0287c15f670eb1d9bb31b7151618a0335ee81f5b638b998cf24700dde0aad86307a5fd406df4ab870c023d8ecc9f224c06ffb86ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16447.exe

Filesize
468KB

MD5
f34cb17ace872c77f4033ac964c34c80

SHA1
9b5b51f5802b8dc694b60af6342998808f8c2b9b

SHA256
1ac3130c575a371ebc6030692f81a1f6c7d9133f9917a4f41ac954128d031e8c

SHA512
1ab604dff2ebc96ad76fdb52102890660594f918c3a7045a4bf96162fd2c7a1127831adbe11152a9e6f0a75c3c0254256de4e5d43826f1539d6b1753a1f4afd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18947.exe

Filesize
468KB

MD5
0a2635084bb653a87a8e2aebd404f8a3

SHA1
a0db3db0e85e31fa8c2980e007e4f4762499b1af

SHA256
d125ebc3679c83d74d309dd33d020d61d442d080f5bb2a8c8ffb4801742794cb

SHA512
6b1a77b6fc293ab2c2ad3966561025ef113f2ca4ac129d40cdc4d061300e9dcd771565ebb836eee1fb4da7ca7fcda197546917fb72d238d37026906f491b4471

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19470.exe

Filesize
468KB

MD5
124f8af439ac9918deae90dfedfa86ce

SHA1
4db760208920e7c246f8a9687ef627a0f72d8449

SHA256
8e55cec7a823e4711dd8e00c2102f67a4e76bf8c9ae5c722def0acb0ab9e3028

SHA512
f437c2f5c1a6105f5f093f643ae19ecf8caedc55f053c245e69183d279d2a3c88593baead1a747a5c31e596b99c41b86c93f4636ddc010befd686d2bbb9e6e92

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2035.exe

Filesize
468KB

MD5
0de55941d12a28a636f19c4f7782dadb

SHA1
728e5267d0d01cfabfa25ed472ab6a03cc24669f

SHA256
30c35ff4a4f32f33a572d0b63395b129151beb3b51a54ae4c74a04c5a56918b2

SHA512
135dedcfa05f34bf727a964b1bb3483646669e0201e4febe1de22ca136224558bc2519813924c97ca8ac182e0b11cdb0eb6b63fab07f379e5cb48f94d7ed3588

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21569.exe

Filesize
468KB

MD5
09f44c501ee03e5492a348030a7c90f1

SHA1
5ab03a22cdea57b0f65d5961ed6d8d11aecb6236

SHA256
5de509e42d48049bd2d75a8bf3bbd8673369933af27518c5d6db59bc5f139965

SHA512
ce897c58e9e71d4f6ede5b3d8af4bea66310efff1d373217ccd34d26f0071d86a8f2c94b0e258d31a8877152c2062142579a79cb2585dd547f10c00f0f83df21

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22455.exe

Filesize
468KB

MD5
1ff68a3cc0b09b51057d414c8de38106

SHA1
4f91cfd97800f7ead54243ff41ae8a44a4eb899d

SHA256
e9b15991f13059835bb1084983ad871999d5eead2f6a8f3e0fc4ec2b9886e221

SHA512
839727f1512172d985bed3ec403df5a40ea02801917019c5759e0a2cca2f3a07fe2ae296f41673fb894b8f4d9223ad685a223996fa42d97a10946da581f572e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23851.exe

Filesize
468KB

MD5
0626871c50a3f1652316edbff2486e8a

SHA1
5911a3da07f672affa466f32f342637674543ee6

SHA256
67918aa69f2ec509e17745dbfccba8a95c7f8348b96efedf904fc2f47891c656

SHA512
d3cc18ed3e0be647cd068c58a04bfadb2745683e2668ef3be81512cd81ca5013ff5da75746324416935c0a4c92bce9534f5a067523f216176f183cb5d2ce9970

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25553.exe

Filesize
468KB

MD5
39ed79a6cbe97be06a0893d04057dfc5

SHA1
015565d35a62c7cc76958eff0771dc5e0a37b23c

SHA256
7e5e89f6633edfff8f7794dd0ee5cef410d619f0b86682cf63d77e4892e1bb24

SHA512
43885b85a50e7c600517c21d6d7587535e2640987a016f0b3709a35ecf54e69d2117c93a9c13c172d6131ba80e66659c997aed486e64a582d5bc4d3e80a7e5cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25985.exe

Filesize
468KB

MD5
11cbdb9399ae6d2dd5186b39ed008859

SHA1
9fe0fea91e20df0123532045e195fdf079182ae5

SHA256
c3c08f16d1cf11d1e0001486205163b3825bf38772525329a9c12fb6a0fac8aa

SHA512
e43f69314a7be9be7503bd56bd46c1e3c11547db8af20d501787946226492791ab2c1d72299fb0209f0d04b06a1b43456d15ff3250739f70daded0154af0d53e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27168.exe

Filesize
468KB

MD5
02d44704911775061f30ebf484e8358f

SHA1
04021413cd35c76b8546f0fe8b6e93103fd1f056

SHA256
275da8a24064ceb32fb058350d63737781827f0b018bf844699a6adc5ba1ec4f

SHA512
98f58aaaf7f250d95d3da158614ad72a54aeaab5e8ebed82dcd4170af276e0899415a86f91e4350b23d01bf3b3ea9664ceafab18f73f3b0865beeed4b42ce7cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27521.exe

Filesize
468KB

MD5
dc946197354b9ec9992a2fd03892263c

SHA1
fe95475e75299e4f734e3185b539e4e4f1e50693

SHA256
c7076de29659cf001ebcf2475fb8f251192769eeb13032ba5bd51ed99b7739fa

SHA512
3a7599610ac42d009efd8ac727307bd7fc29b00a8505646ed9a5bc77bb167d84650445d51117b2e4c3e7657c76d0911fff316de2e9e235d283371e0bb8006c86

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28699.exe

Filesize
468KB

MD5
9b0d77ceb080519036e96c42341043c2

SHA1
e0a91b9377117ee714ce89a73119630cd3868a60

SHA256
393b9ba0d6058cfe9d78da8c10e1510c7f53b5ebc8bb036963c0c568006b148b

SHA512
d0861097005fc62e4ae47d9b83b334d1bb50574d8ccb8f95d0d06c22d04a425efc5dbd74b2bb92c4831c4f8b8d20ea436939eb88f08d4cba7f5abd81ec4ab394

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3042.exe

Filesize
468KB

MD5
5a973fedd8c0d647a23f9bc36704107e

SHA1
a188e335856e321aeeb7f292c730e8c654127f57

SHA256
0e4f099562ccb124e2825743085d6775fb02543ad0242ad2e1058c7d2a2d0d79

SHA512
1cfb977eccc037bf2931255f10ca980006d6e4adc5641fa18ccc6ef9ac9f639a08e5cb259c46e1e2caa10634e5ebeffdff714c19345199a9c44a907004815ee6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30479.exe

Filesize
468KB

MD5
019d28473cf2c42f4408fd2580f36780

SHA1
cd13c48979d790d29e4f202a0fcb4bc8ddfd9941

SHA256
c3fd65d5bfc211da5805eacee893b622e4a8355ac57ff9e081c8f385a3fe35f1

SHA512
0e46b5f4d430c419347a71399169b856d5c6cff51e933a84a9a70ce5fc39cd611da0ca97974a8b59412816a6ef2ed7e2a6508e759114f94f57ff5ede1a164e2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34462.exe

Filesize
468KB

MD5
7efb1e2b74e4fc1355fa455ea4de51ec

SHA1
54a3f076663483d90ac0faf3045de2de56ef040c

SHA256
7c2cdc614c8e56f79dbd8dacb560a0ffd8d73b4500069995a6b44df33fac128e

SHA512
a9ac42c1846d913fbe7c614131c310c230ed7e7d0750f99062fec5508a0d3b9c352e9127d45dffb1e2462e80c2a47769aae53a3cea49b030078281eb6aa78bd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35834.exe

Filesize
468KB

MD5
4e85696f16c69b6f81ecc3b700c9b12f

SHA1
355755dbaad4bc7f27b1cee00e976140194df072

SHA256
c37cbcfe5c479af07738ee8e4ad877065b76181826a9687264386eaec00bd649

SHA512
e051d7ac1401f34691a8c69de6f3c5d0dd2848fa5af7bfaf4ece6fe318ec57cf4c4d44245dceda5b105f3e02fbfbda632d99b0796d8d93525dc7778c46d37902

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36513.exe

Filesize
468KB

MD5
6bdb432346a46c37ba37d0e2d6dbb9c6

SHA1
9105da63d08e6232c39c922154bf559a1e157e36

SHA256
e9f51812283fde095a30d4656f0c43b2d11d7e2e6ff23fbbed80dc811f7b5898

SHA512
cbfd173de67f6a29b1c733970749a580d7072f2a9852127072badb311151bbdadf1f50c74c0d08eef58631eaa7e9c43df02114a17594197df9ff35c1023d587a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37255.exe

Filesize
468KB

MD5
be26d1cd1776fc61a8ff15aca600cac1

SHA1
9ed57368a1e3ad920c0dac4a3483d5e5268973af

SHA256
e8005cdfd4dc139f197c958811def3d399b18dace2e6b65f487bed7a40437efe

SHA512
8d9bbc47cf366b6e676ca52b02378e32b391d05caa8eef60299cfcbf349c111f844b9f6fe344cc3253a236b75aa687484537fce63925b9860d715283b36e471e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37587.exe

Filesize
468KB

MD5
e72ed12db7b2eaab9fcd138be14fee84

SHA1
6058ab327ae24eb2d30cd89a312c69f4d6667a55

SHA256
08d418ca3a1dedc046c4c339b40008c798e57e7ee1880fe92a7e5a909d4d1b5d

SHA512
960277c8cf4512781761dbad3aee43575a1b00953073d97e1726d72550cd9b688982fc1c58354a3c09124565d1cba3a7ef1fa37b8b8423c15d4c0def05f96179

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38237.exe

Filesize
468KB

MD5
d7a5dc367da0a053c432d249f4d59258

SHA1
e129711d50d101017ad07c2b6622e213fa3b934f

SHA256
ad7000d7dfbbecf25a4a09b0da492293526d6bec97d514fe88367bd7652358c0

SHA512
32beb2293150cc955b7df406d709b9915f9a3b5210c0435959db54c675994bf9d83c14823c07b05d82cf334f133e67a5c84f3605eb69629df071396a5f8eb5fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48688.exe

Filesize
468KB

MD5
efcd7b5b7330e9d486477c115cc17a13

SHA1
92c3b09ccf29f28d3204cd3eadf7cb364ce75a4e

SHA256
cb20bf8390cdef8c24f03cf9a29a43deef1e2943efef04d2b2efa86b01f69573

SHA512
1aa15d054a2057b29f636f951df54d75e296f0e9f6bbcc4e07673941388cae5728f04af9b41fd71decf58b5160fceffb326d77ad44ee9b057a5ac2942ff318af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48953.exe

Filesize
468KB

MD5
2d2802828771b3fe5e724963d34840ec

SHA1
44a3d1b8d9d3ba9c72a9d7ad32b3373c64b5e96d

SHA256
b63bcc8cbee984a51173b2606c0adb1dd3f40c0d60a878d7e9d98f56f571d51c

SHA512
631931fd0bee3bbede764811af4e69e71531cc78a29b38edef70d15654ee3188850e42a9d54af50addf5ef172219d6106eb70f8851fe9498d69cd6aee7a4166a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51309.exe

Filesize
468KB

MD5
2cb2375daa5ff5994205d8cb101b4fa8

SHA1
a177ae0a1541ec298adab3cf11c18032aa7d0198

SHA256
2a7a1418215a13673b50b4b94513ee92386fea73682b9361ef9176eb36e8b653

SHA512
aae7f75b671b901f8a4b828bfd1fa4f0e06b2e5270f4aab87b276fb5f9409cb2c7fe0dc9ce0279b4522cde3cc5c09b074218b81c0dac7c74fb54ed574f858b7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53037.exe

Filesize
468KB

MD5
cb782cf09a1168df2b11f6cd071f1f6a

SHA1
ffdcf395548b6164158fdbe4e68f7a0659bf8271

SHA256
89d4f875bead229e7746314bfb0b4fd34dcc5bd761798700d833cf60620e40b9

SHA512
2244a0717ef20eab3001917ea2ec6cb03bb0f25ef43a8030b657e0d04c50ee61d13ccec262f76794eee2347173f5f8192c864c57c92d68131ebf550c7d6560c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53997.exe

Filesize
468KB

MD5
0515eef0da93a0fae2d7857c4bf9a811

SHA1
7daa177090ca6ff0c043b44dcfbe6dfa120143d1

SHA256
3c5cc39223c727db4ce6463805c961247cc407adbe596aa1f560f8c3c615461d

SHA512
229301b56ee63711d53470c2166eec0eb3f3c6da98af94ac77ec173a51b3dd032cfd3bc36b1137589a8b40a504568ae57aeb01f4d54db7f8c2e31cf1b5f5bc69

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55076.exe

Filesize
468KB

MD5
a481b57f4e8bc8414e7a5c5f2e2b504b

SHA1
e5a9842aba9eaf51585dd6b2f44ce94d161ea51e

SHA256
ab5f940cde7f9fddfc2b610640ac2db1d542f2f32d5be7f6767270e6ed5b6019

SHA512
70c3d0c92047fe195197c13cd0137e2333db6f10202096e80328e031fe7c9520f099d04b3858bd9d0d1bd21a566dd2b5944d19dc88b2d98b11e8c1092f408fef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59443.exe

Filesize
468KB

MD5
ed0ba4e5078a706617f0bb49bc421713

SHA1
83177b8b61eecacbc6a870d3938f392285c99db8

SHA256
990f659c6e8477a36709edec1eb176b36097097dda131c9cf682b86e1f5d5029

SHA512
a29bd7f47cbe32ee6775e12f0f58ab23cbc6c2f51dd1cc63baa66df0705f390a537234dce87f97f52dc2f785874cc26ce7251448ededfb50e0e80da52b0e94e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63322.exe

Filesize
468KB

MD5
0c0c153aef1ac9466284dbd2ad2e3b01

SHA1
8d5cfc0a3a03d9c9fd40546d7e1172150f67750c

SHA256
44d6ed930f1e790188963d943f272803599e0d4ea0f984ff31abe7188c16f7b6

SHA512
15aa2cfee926ea97b238cb98df41755eef13b45cc5f003921294235d9b3c4931b64762e90452a4e39f7a7d661941148df77d47097774c7109ae70ff036f71d3d

Download Submit
memory/1792-550-0x0000000002EF0000-0x0000000002FCB000-memory.dmp

Filesize
876KB

Download
memory/1792-549-0x0000000002EF0000-0x0000000002F8B000-memory.dmp

Filesize
620KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads