e9d893cdb0b9f03bc92ac8743b2d851876c774df37cad0e595fedebfe06f8ced

Analysis

max time kernel
120s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 07:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

764a9857eb549bb46f029c5ebfa47020N.exe
Size

468KB
MD5

764a9857eb549bb46f029c5ebfa47020
SHA1

cfbaac32359122e9afe86c1e292d8a81cb9ca20d
SHA256

e9d893cdb0b9f03bc92ac8743b2d851876c774df37cad0e595fedebfe06f8ced
SHA512

cd98a3cc594d6874b7a20c3b08b4a7ae5e90b1749447b63f2327bc2d0bee02ec1c8f7c47dc36bcfe02d4a6b803a9a5a55ecc41d8fa82fbd3412450815437ed45
SSDEEP

3072:13mCogWxjK8p2bxPPz/Czf8/EChbaDpo/mHBaVr73EZ32HIFDbm4:13roBzp2FPbCzfPdtq3EhYIFD

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4780	Unicorn-63068.exe
1936	Unicorn-6379.exe
3752	Unicorn-52051.exe
3600	Unicorn-3203.exe
2876	Unicorn-55974.exe
2856	Unicorn-13409.exe
1392	Unicorn-19540.exe
1300	Unicorn-22332.exe
748	Unicorn-18802.exe
2440	Unicorn-53852.exe
4340	Unicorn-12819.exe
2480	Unicorn-58491.exe
5004	Unicorn-12819.exe
3664	Unicorn-28891.exe
1856	Unicorn-23025.exe
3320	Unicorn-56644.exe
3456	Unicorn-25817.exe
3996	Unicorn-65004.exe
1256	Unicorn-12274.exe
3932	Unicorn-32332.exe
4136	Unicorn-37354.exe
1820	Unicorn-40692.exe
968	Unicorn-40692.exe
4304	Unicorn-40692.exe
4108	Unicorn-49746.exe
2588	Unicorn-36010.exe
1960	Unicorn-55611.exe
4012	Unicorn-52347.exe
1084	Unicorn-63282.exe
3512	Unicorn-32628.exe
4856	Unicorn-4786.exe
1112	Unicorn-13146.exe
4420	Unicorn-13146.exe
4800	Unicorn-31668.exe
2520	Unicorn-31668.exe
3076	Unicorn-17561.exe
924	Unicorn-9586.exe
3584	Unicorn-26188.exe
4928	Unicorn-26188.exe
2160	Unicorn-42908.exe
1480	Unicorn-21698.exe
3916	Unicorn-43602.exe
5012	Unicorn-43602.exe
1352	Unicorn-49732.exe
1060	Unicorn-49924.exe
2312	Unicorn-54563.exe
4552	Unicorn-13530.exe
4912	Unicorn-915.exe
5060	Unicorn-25420.exe
3740	Unicorn-22274.exe
2836	Unicorn-24842.exe
2636	Unicorn-58476.exe
4328	Unicorn-11714.exe
4436	Unicorn-31315.exe
4248	Unicorn-17444.exe
760	Unicorn-33617.exe
4332	Unicorn-47154.exe
3096	Unicorn-50028.exe
2428	Unicorn-45155.exe
3180	Unicorn-65020.exe
4700	Unicorn-59082.exe
4948	Unicorn-50988.exe
1504	Unicorn-18124.exe
220	Unicorn-26292.exe

Program crash 9 IoCs

pid	pid_target	Process	procid_target
7704	3892	WerFault.exe	168
7668	5916	WerFault.exe	200
7456	6332	WerFault.exe	243
7848	5916	WerFault.exe	200
876	1636	WerFault.exe	169
9272	5848	WerFault.exe	216
11032	6332	WerFault.exe	243
2096	6428	WerFault.exe	249
4740	6836	WerFault.exe	337

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44938.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4786.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8770.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61284.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41050.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24697.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25420.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54771.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12802.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48345.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8529.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46611.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27489.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64780.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65355.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8770.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13866.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63978.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26292.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11388.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58411.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55347.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34043.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5729.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64371.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	764a9857eb549bb46f029c5ebfa47020N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58826.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13866.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39099.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42194.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29004.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7978.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25372.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59355.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58411.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49955.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49746.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21929.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33969.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6785.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6411.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31611.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52811.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58411.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31315.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6027.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63978.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63978.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64947.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12659.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59315.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27658.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36796.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17386.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45994.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16568	dwm.exe
Token: SeChangeNotifyPrivilege	16568	dwm.exe
Token: 33	16568	dwm.exe
Token: SeIncBasePriorityPrivilege	16568	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2708	764a9857eb549bb46f029c5ebfa47020N.exe
4780	Unicorn-63068.exe
3752	Unicorn-52051.exe
1936	Unicorn-6379.exe
3600	Unicorn-3203.exe
2856	Unicorn-13409.exe
2876	Unicorn-55974.exe
1392	Unicorn-19540.exe
748	Unicorn-18802.exe
1300	Unicorn-22332.exe
2440	Unicorn-53852.exe
2480	Unicorn-58491.exe
1856	Unicorn-23025.exe
5004	Unicorn-12819.exe
3664	Unicorn-28891.exe
4340	Unicorn-12819.exe
3320	Unicorn-56644.exe
3456	Unicorn-25817.exe
3996	Unicorn-65004.exe
1256	Unicorn-12274.exe
3932	Unicorn-32332.exe
4136	Unicorn-37354.exe
4012	Unicorn-52347.exe
1084	Unicorn-63282.exe
1820	Unicorn-40692.exe
4108	Unicorn-49746.exe
4304	Unicorn-40692.exe
2588	Unicorn-36010.exe
1960	Unicorn-55611.exe
968	Unicorn-40692.exe
3512	Unicorn-32628.exe
4856	Unicorn-4786.exe
1112	Unicorn-13146.exe
4420	Unicorn-13146.exe
4800	Unicorn-31668.exe
3076	Unicorn-17561.exe
2520	Unicorn-31668.exe
924	Unicorn-9586.exe
3584	Unicorn-26188.exe
4928	Unicorn-26188.exe
2160	Unicorn-42908.exe
3916	Unicorn-43602.exe
1352	Unicorn-49732.exe
5012	Unicorn-43602.exe
1480	Unicorn-21698.exe
2312	Unicorn-54563.exe
4552	Unicorn-13530.exe
1060	Unicorn-49924.exe
4248	Unicorn-17444.exe
4912	Unicorn-915.exe
4328	Unicorn-11714.exe
4332	Unicorn-47154.exe
4436	Unicorn-31315.exe
2836	Unicorn-24842.exe
2636	Unicorn-58476.exe
760	Unicorn-33617.exe
3740	Unicorn-22274.exe
5060	Unicorn-25420.exe
3096	Unicorn-50028.exe
2428	Unicorn-45155.exe
3180	Unicorn-65020.exe
4700	Unicorn-59082.exe
4948	Unicorn-50988.exe
2884	Unicorn-55819.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 4780	2708	764a9857eb549bb46f029c5ebfa47020N.exe	86
PID 2708 wrote to memory of 4780	2708	764a9857eb549bb46f029c5ebfa47020N.exe	86
PID 2708 wrote to memory of 4780	2708	764a9857eb549bb46f029c5ebfa47020N.exe	86
PID 4780 wrote to memory of 1936	4780	Unicorn-63068.exe	91
PID 4780 wrote to memory of 1936	4780	Unicorn-63068.exe	91
PID 4780 wrote to memory of 1936	4780	Unicorn-63068.exe	91
PID 2708 wrote to memory of 3752	2708	764a9857eb549bb46f029c5ebfa47020N.exe	92
PID 2708 wrote to memory of 3752	2708	764a9857eb549bb46f029c5ebfa47020N.exe	92
PID 2708 wrote to memory of 3752	2708	764a9857eb549bb46f029c5ebfa47020N.exe	92
PID 3752 wrote to memory of 3600	3752	Unicorn-52051.exe	94
PID 3752 wrote to memory of 3600	3752	Unicorn-52051.exe	94
PID 3752 wrote to memory of 3600	3752	Unicorn-52051.exe	94
PID 1936 wrote to memory of 1392	1936	Unicorn-6379.exe	95
PID 1936 wrote to memory of 1392	1936	Unicorn-6379.exe	95
PID 1936 wrote to memory of 1392	1936	Unicorn-6379.exe	95
PID 4780 wrote to memory of 2876	4780	Unicorn-63068.exe	96
PID 4780 wrote to memory of 2876	4780	Unicorn-63068.exe	96
PID 4780 wrote to memory of 2876	4780	Unicorn-63068.exe	96
PID 2708 wrote to memory of 2856	2708	764a9857eb549bb46f029c5ebfa47020N.exe	97
PID 2708 wrote to memory of 2856	2708	764a9857eb549bb46f029c5ebfa47020N.exe	97
PID 2708 wrote to memory of 2856	2708	764a9857eb549bb46f029c5ebfa47020N.exe	97
PID 3600 wrote to memory of 1300	3600	Unicorn-3203.exe	100
PID 3600 wrote to memory of 1300	3600	Unicorn-3203.exe	100
PID 3600 wrote to memory of 1300	3600	Unicorn-3203.exe	100
PID 3752 wrote to memory of 748	3752	Unicorn-52051.exe	101
PID 3752 wrote to memory of 748	3752	Unicorn-52051.exe	101
PID 3752 wrote to memory of 748	3752	Unicorn-52051.exe	101
PID 1392 wrote to memory of 2440	1392	Unicorn-19540.exe	102
PID 1392 wrote to memory of 2440	1392	Unicorn-19540.exe	102
PID 1392 wrote to memory of 2440	1392	Unicorn-19540.exe	102
PID 2876 wrote to memory of 4340	2876	Unicorn-55974.exe	103
PID 2876 wrote to memory of 4340	2876	Unicorn-55974.exe	103
PID 2876 wrote to memory of 4340	2876	Unicorn-55974.exe	103
PID 2856 wrote to memory of 5004	2856	Unicorn-13409.exe	105
PID 2856 wrote to memory of 5004	2856	Unicorn-13409.exe	105
PID 2856 wrote to memory of 5004	2856	Unicorn-13409.exe	105
PID 1936 wrote to memory of 2480	1936	Unicorn-6379.exe	104
PID 1936 wrote to memory of 2480	1936	Unicorn-6379.exe	104
PID 1936 wrote to memory of 2480	1936	Unicorn-6379.exe	104
PID 2708 wrote to memory of 3664	2708	764a9857eb549bb46f029c5ebfa47020N.exe	106
PID 2708 wrote to memory of 3664	2708	764a9857eb549bb46f029c5ebfa47020N.exe	106
PID 2708 wrote to memory of 3664	2708	764a9857eb549bb46f029c5ebfa47020N.exe	106
PID 4780 wrote to memory of 1856	4780	Unicorn-63068.exe	107
PID 4780 wrote to memory of 1856	4780	Unicorn-63068.exe	107
PID 4780 wrote to memory of 1856	4780	Unicorn-63068.exe	107
PID 748 wrote to memory of 3320	748	Unicorn-18802.exe	108
PID 748 wrote to memory of 3320	748	Unicorn-18802.exe	108
PID 748 wrote to memory of 3320	748	Unicorn-18802.exe	108
PID 3752 wrote to memory of 3456	3752	Unicorn-52051.exe	109
PID 3752 wrote to memory of 3456	3752	Unicorn-52051.exe	109
PID 3752 wrote to memory of 3456	3752	Unicorn-52051.exe	109
PID 1300 wrote to memory of 3996	1300	Unicorn-22332.exe	110
PID 1300 wrote to memory of 3996	1300	Unicorn-22332.exe	110
PID 1300 wrote to memory of 3996	1300	Unicorn-22332.exe	110
PID 3600 wrote to memory of 1256	3600	Unicorn-3203.exe	111
PID 3600 wrote to memory of 1256	3600	Unicorn-3203.exe	111
PID 3600 wrote to memory of 1256	3600	Unicorn-3203.exe	111
PID 2440 wrote to memory of 3932	2440	Unicorn-53852.exe	112
PID 2440 wrote to memory of 3932	2440	Unicorn-53852.exe	112
PID 2440 wrote to memory of 3932	2440	Unicorn-53852.exe	112
PID 1392 wrote to memory of 4136	1392	Unicorn-19540.exe	113
PID 1392 wrote to memory of 4136	1392	Unicorn-19540.exe	113
PID 1392 wrote to memory of 4136	1392	Unicorn-19540.exe	113
PID 1856 wrote to memory of 968	1856	Unicorn-23025.exe	114

C:\Users\Admin\AppData\Local\Temp\764a9857eb549bb46f029c5ebfa47020N.exe
"C:\Users\Admin\AppData\Local\Temp\764a9857eb549bb46f029c5ebfa47020N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63068.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63068.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6379.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6379.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19540.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53852.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32332.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49732.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11875.exe
        8⤵
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14091.exe
        9⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8635.exe
        10⤵
        
        PID:8596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45460.exe
        11⤵
        
        PID:11380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:8460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22994.exe
        10⤵
        
        PID:13004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        10⤵
        
        PID:18200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46627.exe
        9⤵
        
        PID:8776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52226.exe
        9⤵
        
        PID:14852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35746.exe
        8⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52372.exe
        9⤵
        
        PID:10096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-642.exe
        9⤵
        
        PID:15032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6618.exe
        9⤵
        
        PID:12512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31059.exe
        8⤵
        
        PID:11668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61178.exe
        8⤵
        
        PID:16952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56586.exe
        7⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21028.exe
        8⤵
        
        PID:7896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6627.exe
        9⤵
        
        PID:11760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        9⤵
        
        PID:17752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39100.exe
        9⤵
        
        PID:12820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12802.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8529.exe
        8⤵
        
        PID:18064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50067.exe
        7⤵
        
        PID:8220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25964.exe
        8⤵
        
        PID:14248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2474.exe
        8⤵
        
        PID:208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64682.exe
        7⤵
        
        PID:12916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52811.exe
        7⤵
        
        PID:16760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54563.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11875.exe
        7⤵
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60988.exe
        8⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64932.exe
        9⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52372.exe
        10⤵
        
        PID:9212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33314.exe
        10⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64371.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:11732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-986.exe
        9⤵
        
        PID:10580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57922.exe
        9⤵
        
        PID:18328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34987.exe
        8⤵
        
        PID:8444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41050.exe
        8⤵
        
        PID:13764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52811.exe
        8⤵
        
        PID:16644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33442.exe
        7⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37084.exe
        8⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        8⤵
        
        PID:18004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31059.exe
        7⤵
        
        PID:11680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61178.exe
        7⤵
        
        PID:16936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43810.exe
        6⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28996.exe
        7⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6332 -s 636
        8⤵
        Program crash
        
        PID:7456
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6332 -s 636
        8⤵
        Program crash
        
        PID:11032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5402.exe
        7⤵
        
        PID:8476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42890.exe
        7⤵
        
        PID:13876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16004.exe
        7⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53819.exe
        6⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35932.exe
        7⤵
        
        PID:9476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        7⤵
        
        PID:17988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27489.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26666.exe
        6⤵
        
        PID:16016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37354.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42908.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17386.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        8⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5802.exe
        9⤵
        
        PID:13528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65006.exe
        9⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-881.exe
        8⤵
        
        PID:12072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62531.exe
        8⤵
        
        PID:16120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24985.exe
        7⤵
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53420.exe
        8⤵
        
        PID:8580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24988.exe
        9⤵
        
        PID:13252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        9⤵
        
        PID:18320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4266.exe
        8⤵
        
        PID:13816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        8⤵
        
        PID:17964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20970.exe
        7⤵
        
        PID:10728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37233.exe
        7⤵
        
        PID:15748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24298.exe
        6⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6027.exe
        7⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34780.exe
        8⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63194.exe
        8⤵
        
        PID:14688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3931.exe
        8⤵
        
        PID:1320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8194.exe
        7⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11388.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7689.exe
        6⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53628.exe
        7⤵
        
        PID:11912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50243.exe
        7⤵
        
        PID:17760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56139.exe
        6⤵
        
        PID:12124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61178.exe
        6⤵
        
        PID:16928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43602.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28020.exe
        6⤵
        
        PID:1524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3619.exe
        7⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58220.exe
        8⤵
        
        PID:8684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45652.exe
        9⤵
        
        PID:11064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        9⤵
        
        PID:17836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13866.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        8⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54219.exe
        7⤵
        
        PID:9156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60570.exe
        7⤵
        
        PID:12884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4306.exe
        7⤵
        
        PID:2044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65155.exe
        6⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8443.exe
        7⤵
        
        PID:8532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53628.exe
        8⤵
        
        PID:11348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        8⤵
        
        PID:17860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46923.exe
        7⤵
        
        PID:12736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-361.exe
        7⤵
        
        PID:18056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19137.exe
        6⤵
        
        PID:3372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48755.exe
        6⤵
        
        PID:13884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65006.exe
        6⤵
        
        PID:16616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49675.exe
        5⤵
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6027.exe
        6⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27572.exe
        7⤵
        
        PID:9620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54155.exe
        7⤵
        
        PID:14748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        7⤵
        
        PID:17892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16362.exe
        6⤵
        
        PID:10004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11388.exe
        6⤵
        
        PID:14784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11139.exe
        6⤵
        
        PID:11328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4889.exe
        5⤵
        
        PID:8152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47852.exe
        6⤵
        
        PID:12212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        6⤵
        
        PID:6140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30938.exe
        5⤵
        
        PID:12108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61708.exe
        5⤵
        
        PID:16684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58491.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13146.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50988.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59836.exe
        7⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22172.exe
        8⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16554.exe
        9⤵
        
        PID:10844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14268.exe
        9⤵
        
        PID:15432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26066.exe
        8⤵
        
        PID:10636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14865.exe
        8⤵
        
        PID:16124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2698.exe
        7⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe
        8⤵
        
        PID:9468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        8⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47114.exe
        7⤵
        
        PID:10468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4306.exe
        7⤵
        
        PID:1420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48523.exe
        6⤵
        
        PID:852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6411.exe
        7⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26258.exe
        8⤵
        
        PID:10372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8529.exe
        8⤵
        
        PID:18072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-881.exe
        7⤵
        
        PID:12056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54363.exe
        7⤵
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22210.exe
        6⤵
        
        PID:8384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe
        7⤵
        
        PID:12268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        7⤵
        
        PID:17192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56898.exe
        6⤵
        
        PID:13156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52811.exe
        6⤵
        
        PID:16824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53218.exe
        5⤵
        
        PID:1872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45804.exe
        6⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48796.exe
        7⤵
        
        PID:8080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23068.exe
        8⤵
        
        PID:10608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        8⤵
        
        PID:16864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59803.exe
        7⤵
        
        PID:12640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        7⤵
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29418.exe
        6⤵
        
        PID:8796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12787.exe
        7⤵
        
        PID:11560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        7⤵
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41738.exe
        6⤵
        
        PID:13384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4306.exe
        6⤵
        
        PID:17712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55347.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4027.exe
        6⤵
        
        PID:9320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        6⤵
        
        PID:17128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5858.exe
        5⤵
        
        PID:11660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60540.exe
        5⤵
        
        PID:16720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49746.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58476.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44164.exe
        6⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61284.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36124.exe
        8⤵
        
        PID:10228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        8⤵
        
        PID:17940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65179.exe
        7⤵
        
        PID:10236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44938.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3931.exe
        7⤵
        
        PID:11424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12010.exe
        6⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36124.exe
        7⤵
        
        PID:10220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54155.exe
        7⤵
        
        PID:14760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        7⤵
        
        PID:17120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30289.exe
        6⤵
        
        PID:10752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13802.exe
        6⤵
        
        PID:1924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30266.exe
        5⤵
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6027.exe
        6⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22609.exe
        7⤵
        
        PID:10184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57229.exe
        7⤵
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49698.exe
        6⤵
        
        PID:11708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57229.exe
        6⤵
        
        PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22210.exe
        5⤵
        
        PID:8392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12787.exe
        6⤵
        
        PID:11740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        6⤵
        
        PID:17820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56898.exe
        5⤵
        
        PID:13164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16534.exe
        5⤵
        
        PID:17232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31315.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59187.exe
        5⤵
        
        PID:6116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7763.exe
        6⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8770.exe
        7⤵
        
        PID:11092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6977.exe
        7⤵
        
        PID:15664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22380.exe
        7⤵
        
        PID:13072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16554.exe
        6⤵
        
        PID:10860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64922.exe
        6⤵
        
        PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51322.exe
        5⤵
        
        PID:8816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64292.exe
        6⤵
        
        PID:12296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50243.exe
        6⤵
        
        PID:17792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47603.exe
        5⤵
        
        PID:13356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3809.exe
        5⤵
        
        PID:17652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-169.exe
      4⤵
      PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6027.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26228.exe
        6⤵
        
        PID:9376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        6⤵
        
        PID:6108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15018.exe
        5⤵
        
        PID:9308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43002.exe
        5⤵
        
        PID:14696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2395.exe
        5⤵
        
        PID:11352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53891.exe
      4⤵
      PID:8168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47380.exe
        5⤵
        
        PID:12084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        5⤵
        
        PID:17884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6587.exe
      4⤵
      PID:11888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24697.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55974.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55974.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12819.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40692.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63603.exe
        6⤵
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52628.exe
        7⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43538.exe
        8⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16554.exe
        9⤵
        
        PID:10828
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6836 -s 636
        9⤵
        Program crash
        
        PID:4740
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5848 -s 656
        8⤵
        Program crash
        
        PID:9272
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3892 -s 636
        7⤵
        Program crash
        
        PID:7704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63515.exe
        6⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8770.exe
        7⤵
        
        PID:11136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46962.exe
        7⤵
        
        PID:16272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27297.exe
        6⤵
        
        PID:10084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4339.exe
        6⤵
        
        PID:17244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11714.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8907.exe
        6⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63204.exe
        7⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20748.exe
        8⤵
        
        PID:9548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63436.exe
        9⤵
        
        PID:13592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        9⤵
        
        PID:16852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23778.exe
        8⤵
        
        PID:13868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56090.exe
        8⤵
        
        PID:16220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7810.exe
        7⤵
        
        PID:9532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62530.exe
        7⤵
        
        PID:16028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59491.exe
        6⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19124.exe
        7⤵
        
        PID:9508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35338.exe
        7⤵
        
        PID:16024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58826.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14970.exe
        6⤵
        
        PID:18340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2969.exe
        5⤵
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27268.exe
        6⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8635.exe
        7⤵
        
        PID:8584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15283.exe
        8⤵
        
        PID:12412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        8⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22994.exe
        7⤵
        
        PID:13016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        7⤵
        
        PID:18288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46627.exe
        6⤵
        
        PID:8768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18577.exe
        6⤵
        
        PID:13928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4306.exe
        6⤵
        
        PID:17636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31611.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31324.exe
        6⤵
        
        PID:12196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4394.exe
        6⤵
        
        PID:16408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19705.exe
        5⤵
        
        PID:11120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28866.exe
        5⤵
        
        PID:15772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52347.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26188.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42436.exe
        6⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28316.exe
        7⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64932.exe
        8⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34780.exe
        9⤵
        
        PID:9204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36770.exe
        9⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3931.exe
        9⤵
        
        PID:12336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9049.exe
        8⤵
        
        PID:12040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57229.exe
        8⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34987.exe
        7⤵
        
        PID:8372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34186.exe
        8⤵
        
        PID:16204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41050.exe
        7⤵
        
        PID:13716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52811.exe
        7⤵
        
        PID:17364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39690.exe
        6⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36892.exe
        7⤵
        
        PID:8216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        7⤵
        
        PID:17948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22785.exe
        6⤵
        
        PID:9412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8218.exe
        6⤵
        
        PID:14800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65006.exe
        6⤵
        
        PID:17224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64947.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20828.exe
        6⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18060.exe
        7⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63194.exe
        7⤵
        
        PID:14792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44964.exe
        7⤵
        
        PID:3868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59787.exe
        6⤵
        
        PID:10100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34459.exe
        6⤵
        
        PID:11068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39786.exe
        5⤵
        
        PID:7536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3259.exe
        6⤵
        
        PID:10060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-533.exe
        6⤵
        
        PID:15732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52683.exe
        5⤵
        
        PID:11004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12345.exe
        5⤵
        
        PID:15376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43602.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23441.exe
        5⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20748.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22018.exe
        5⤵
        
        PID:10136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52811.exe
        5⤵
        
        PID:17348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53786.exe
      4⤵
      PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29004.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23068.exe
        6⤵
        
        PID:11324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        6⤵
        
        PID:6112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12802.exe
        5⤵
        
        PID:11552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8721.exe
        5⤵
        
        PID:18156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47450.exe
      4⤵
      PID:7616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26140.exe
        5⤵
        
        PID:12828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27850.exe
        5⤵
        
        PID:18292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28700.exe
      4⤵
      PID:10880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40177.exe
      4⤵
      PID:16708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23025.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23025.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40692.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25420.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10723.exe
        6⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60516.exe
        7⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45060.exe
        8⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54155.exe
        8⤵
        
        PID:14776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        8⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9050.exe
        7⤵
        
        PID:9388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2353.exe
        7⤵
        
        PID:14788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57229.exe
        7⤵
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45259.exe
        6⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16554.exe
        7⤵
        
        PID:10836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24465.exe
        7⤵
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14721.exe
        6⤵
        
        PID:10540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38899.exe
        6⤵
        
        PID:18140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40634.exe
        5⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61284.exe
        6⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45252.exe
        7⤵
        
        PID:8676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        7⤵
        
        PID:2004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65179.exe
        6⤵
        
        PID:9716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63770.exe
        6⤵
        
        PID:14652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3931.exe
        6⤵
        
        PID:12304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39018.exe
        5⤵
        
        PID:7732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31044.exe
        6⤵
        
        PID:10800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        6⤵
        
        PID:16800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37883.exe
        5⤵
        
        PID:10452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54930.exe
        5⤵
        
        PID:18280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22274.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49940.exe
        5⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6027.exe
        6⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36892.exe
        7⤵
        
        PID:9644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25964.exe
        8⤵
        
        PID:13136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58774.exe
        8⤵
        
        PID:15372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        7⤵
        
        PID:17740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49698.exe
        6⤵
        
        PID:11692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57229.exe
        6⤵
        
        PID:4440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34987.exe
        5⤵
        
        PID:8368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41050.exe
        5⤵
        
        PID:14240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52811.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52170.exe
      4⤵
      PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21788.exe
        5⤵
        
        PID:7152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3923.exe
        6⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48252.exe
        7⤵
        
        PID:13468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        7⤵
        
        PID:17852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30114.exe
        6⤵
        
        PID:13724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        6⤵
        
        PID:18336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24426.exe
        5⤵
        
        PID:9732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16004.exe
        5⤵
        
        PID:6104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46611.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1075.exe
        5⤵
        
        PID:14056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        5⤵
        
        PID:2684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64578.exe
      4⤵
      PID:11612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44642.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55611.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55611.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17444.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65242.exe
        5⤵
        
        PID:6728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12787.exe
        6⤵
        
        PID:12088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27411.exe
        5⤵
        
        PID:9540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12449.exe
        5⤵
        
        PID:16176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54771.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6027.exe
        5⤵
        
        PID:6928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61292.exe
        6⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49563.exe
        7⤵
        
        PID:16336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30114.exe
        6⤵
        
        PID:13772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6609.exe
        6⤵
        
        PID:16520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24426.exe
        5⤵
        
        PID:9800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57229.exe
        5⤵
        
        PID:5172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65058.exe
      4⤵
      PID:8160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
        5⤵
        
        PID:9484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        5⤵
        
        PID:18012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53835.exe
      4⤵
      PID:10656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20705.exe
      4⤵
      PID:15724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47154.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47154.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50132.exe
      4⤵
      PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20444.exe
        5⤵
        
        PID:6540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25356.exe
        6⤵
        
        PID:8736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31044.exe
        7⤵
        
        PID:12132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        7⤵
        
        PID:16784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13866.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21546.exe
        5⤵
        
        PID:7980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29049.exe
        5⤵
        
        PID:14108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4306.exe
        5⤵
        
        PID:18024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3730.exe
        5⤵
        
        PID:11468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18545.exe
      4⤵
      PID:7344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16554.exe
        5⤵
        
        PID:10868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6785.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4634.exe
      4⤵
      PID:10692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45018.exe
      4⤵
      PID:15444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49170.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49170.exe
    3⤵
    PID:5448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6027.exe
      4⤵
      PID:6920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52372.exe
        5⤵
        
        PID:10124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40818.exe
        5⤵
        
        PID:16052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14314.exe
        5⤵
        
        PID:19060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49698.exe
      4⤵
      PID:11700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57229.exe
      4⤵
      PID:5936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5419.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5419.exe
    3⤵
    PID:8092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60540.exe
      4⤵
      PID:3224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59355.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43577.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43577.exe
    3⤵
    PID:12160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13114.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13114.exe
    3⤵
    PID:1092
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52051.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52051.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3203.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3203.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22332.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65004.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26188.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42436.exe
        7⤵
        
        PID:212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35908.exe
        8⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6411.exe
        9⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44292.exe
        10⤵
        
        PID:9900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50907.exe
        10⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31354.exe
        9⤵
        
        PID:9452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14953.exe
        9⤵
        
        PID:932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11250.exe
        8⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5802.exe
        9⤵
        
        PID:13532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61178.exe
        9⤵
        
        PID:17684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22313.exe
        8⤵
        
        PID:10956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13610.exe
        8⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39970.exe
        7⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8770.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6977.exe
        8⤵
        
        PID:15696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59315.exe
        7⤵
        
        PID:10276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61178.exe
        7⤵
        
        PID:13220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24298.exe
        6⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4107.exe
        7⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36316.exe
        8⤵
        
        PID:9876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        8⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18177.exe
        7⤵
        
        PID:11628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57229.exe
        7⤵
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55930.exe
        6⤵
        
        PID:7852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe
        7⤵
        
        PID:9684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        7⤵
        
        PID:5032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32403.exe
        6⤵
        
        PID:11580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65006.exe
        6⤵
        
        PID:17240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21698.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23441.exe
        6⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16804.exe
        7⤵
        
        PID:8692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45460.exe
        8⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13866.exe
        7⤵
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        7⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8858.exe
        6⤵
        
        PID:8864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9611.exe
        7⤵
        
        PID:12800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44379.exe
        7⤵
        
        PID:18364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40282.exe
        6⤵
        
        PID:13420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52811.exe
        6⤵
        
        PID:17812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54283.exe
        5⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62636.exe
        6⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12787.exe
        7⤵
        
        PID:12120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        7⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53643.exe
        6⤵
        
        PID:11724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        6⤵
        
        PID:17100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32849.exe
        5⤵
        
        PID:7680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56315.exe
        5⤵
        
        PID:12932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60540.exe
        5⤵
        
        PID:16896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12274.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31668.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18124.exe
        6⤵
        Executes dropped EXE
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53204.exe
        7⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30148.exe
        8⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3923.exe
        9⤵
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-675.exe
        10⤵
        
        PID:11840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        10⤵
        
        PID:17340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30114.exe
        9⤵
        
        PID:13780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        9⤵
        
        PID:17924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48739.exe
        8⤵
        
        PID:9500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64780.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9833.exe
        8⤵
        
        PID:13800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12474.exe
        8⤵
        
        PID:17256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51323.exe
        7⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27100.exe
        8⤵
        
        PID:10340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2370.exe
        8⤵
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50274.exe
        7⤵
        
        PID:12140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12645.exe
        7⤵
        
        PID:1468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39970.exe
        6⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34426.exe
        7⤵
        
        PID:9908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-361.exe
        7⤵
        
        PID:18044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59315.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11577.exe
        6⤵
        
        PID:14968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54932.exe
        6⤵
        
        PID:12808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14978.exe
        5⤵
        
        PID:2116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58331.exe
        6⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36892.exe
        7⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        7⤵
        
        PID:3104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14338.exe
        6⤵
        
        PID:9296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5729.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        5⤵
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8635.exe
        6⤵
        
        PID:8664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10379.exe
        7⤵
        
        PID:10320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59547.exe
        7⤵
        
        PID:14844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49955.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11842.exe
        6⤵
        
        PID:11920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48498.exe
        6⤵
        
        PID:4576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-690.exe
        5⤵
        
        PID:8592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15777.exe
        5⤵
        
        PID:13924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16534.exe
        5⤵
        
        PID:14028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17561.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34844.exe
        5⤵
        
        PID:2384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19572.exe
        6⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38316.exe
        7⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61780.exe
        8⤵
        
        PID:9336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        8⤵
        
        PID:17908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7234.exe
        7⤵
        
        PID:10412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14953.exe
        7⤵
        
        PID:14816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51323.exe
        6⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe
        7⤵
        
        PID:12260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        7⤵
        
        PID:16620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34043.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54738.exe
        6⤵
        
        PID:18224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33914.exe
        5⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48796.exe
        6⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe
        7⤵
        
        PID:12156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59803.exe
        6⤵
        
        PID:12624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6609.exe
        6⤵
        
        PID:17676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43154.exe
        5⤵
        
        PID:8788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47603.exe
        5⤵
        
        PID:13396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65006.exe
        5⤵
        
        PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9882.exe
      4⤵
      PID:2952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28700.exe
        5⤵
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6411.exe
        6⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52372.exe
        7⤵
        
        PID:9844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64939.exe
        7⤵
        
        PID:15912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31354.exe
        6⤵
        
        PID:9444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40610.exe
        6⤵
        
        PID:2432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60538.exe
        5⤵
        
        PID:8264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12787.exe
        6⤵
        
        PID:11720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        6⤵
        
        PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26.exe
        5⤵
        
        PID:13120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65006.exe
        5⤵
        
        PID:6052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29089.exe
      4⤵
      PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56964.exe
        5⤵
        
        PID:8084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12595.exe
        6⤵
        
        PID:9224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        6⤵
        
        PID:17876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59803.exe
        5⤵
        
        PID:12648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        5⤵
        
        PID:16524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23818.exe
      4⤵
      PID:8780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13866.exe
        5⤵
        
        PID:11604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        5⤵
        
        PID:17900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47916.exe
      4⤵
      PID:11516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48345.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18802.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18802.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32628.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50028.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57340.exe
        7⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45140.exe
        8⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33083.exe
        9⤵
        
        PID:13024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3809.exe
        9⤵
        
        PID:17308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16362.exe
        8⤵
        
        PID:9992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5825.exe
        8⤵
        
        PID:14804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44964.exe
        8⤵
        
        PID:11564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42194.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52372.exe
        8⤵
        
        PID:9964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57435.exe
        8⤵
        
        PID:388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39099.exe
        8⤵
        
        PID:11488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26537.exe
        7⤵
        
        PID:11568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16004.exe
        7⤵
        
        PID:16592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45643.exe
        6⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6027.exe
        7⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16804.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14515.exe
        9⤵
        
        PID:12224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        9⤵
        
        PID:16792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13866.exe
        8⤵
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        8⤵
        
        PID:18236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54939.exe
        8⤵
        
        PID:12876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12994.exe
        7⤵
        
        PID:8680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11753.exe
        7⤵
        
        PID:14208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16004.exe
        7⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26321.exe
        6⤵
        
        PID:8360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17780.exe
        7⤵
        
        PID:12768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51286.exe
        7⤵
        
        PID:18168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24514.exe
        6⤵
        
        PID:13732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60540.exe
        6⤵
        
        PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45155.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57724.exe
        6⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29580.exe
        7⤵
        
        PID:7716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6627.exe
        8⤵
        
        PID:11820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        8⤵
        
        PID:16608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18282.exe
        7⤵
        
        PID:10500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57730.exe
        7⤵
        
        PID:18264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20570.exe
        6⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56124.exe
        7⤵
        
        PID:11836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        7⤵
        
        PID:17828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8001.exe
        6⤵
        
        PID:12588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16004.exe
        6⤵
        
        PID:5492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35450.exe
        5⤵
        
        PID:5916
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5916 -s 632
        6⤵
        Program crash
        
        PID:7668
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5916 -s 632
        6⤵
        Program crash
        
        PID:7848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13554.exe
        5⤵
        
        PID:8112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24308.exe
        6⤵
        
        PID:12016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        6⤵
        
        PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6057.exe
        5⤵
        
        PID:11876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37522.exe
        5⤵
        
        PID:844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4786.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65020.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26972.exe
        6⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14387.exe
        7⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6627.exe
        8⤵
        
        PID:11780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18177.exe
        7⤵
        
        PID:11652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4306.exe
        7⤵
        
        PID:18032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51323.exe
        6⤵
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23068.exe
        7⤵
        
        PID:10424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        7⤵
        
        PID:16808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8857.exe
        6⤵
        
        PID:11900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62531.exe
        6⤵
        
        PID:16072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15274.exe
        5⤵
        
        PID:6000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54660.exe
        6⤵
        
        PID:7752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53628.exe
        7⤵
        
        PID:11528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        7⤵
        
        PID:17844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53451.exe
        6⤵
        
        PID:11536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8529.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35650.exe
        5⤵
        
        PID:8204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37292.exe
        6⤵
        
        PID:11432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        6⤵
        
        PID:16872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15978.exe
        5⤵
        
        PID:12924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65006.exe
        5⤵
        
        PID:5744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59082.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8715.exe
        5⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14003.exe
        6⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44292.exe
        7⤵
        
        PID:9832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54155.exe
        7⤵
        
        PID:14736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45731.exe
        7⤵
        
        PID:7808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7810.exe
        6⤵
        
        PID:9432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39562.exe
        6⤵
        
        PID:16140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34987.exe
        5⤵
        
        PID:8416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25372.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        6⤵
        
        PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41050.exe
        5⤵
        
        PID:13748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16534.exe
        5⤵
        
        PID:6064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26707.exe
      4⤵
      PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6027.exe
        5⤵
        
        PID:6848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8635.exe
        6⤵
        
        PID:8608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe
        7⤵
        
        PID:12248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        7⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6658.exe
        6⤵
        
        PID:12900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        6⤵
        
        PID:17980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46627.exe
        5⤵
        
        PID:8616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33969.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52820.exe
        5⤵
        
        PID:12504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62258.exe
      4⤵
      PID:8072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56818.exe
        5⤵
        
        PID:12360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12474.exe
        5⤵
        
        PID:17704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10954.exe
      4⤵
      PID:10776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45932.exe
      4⤵
      PID:15784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25817.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25817.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31668.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59348.exe
        5⤵
        
        PID:2892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3043.exe
        6⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38316.exe
        7⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52372.exe
        8⤵
        
        PID:9856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-533.exe
        8⤵
        
        PID:15420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-881.exe
        7⤵
        
        PID:12064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62147.exe
        7⤵
        
        PID:16200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16345.exe
        6⤵
        
        PID:8408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39492.exe
        7⤵
        
        PID:11748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        7⤵
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26.exe
        6⤵
        
        PID:13140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3809.exe
        6⤵
        
        PID:17288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39970.exe
        5⤵
        
        PID:7128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21148.exe
        6⤵
        
        PID:11608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        6⤵
        
        PID:17392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59315.exe
        5⤵
        
        PID:10284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38786.exe
        5⤵
        
        PID:17016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55819.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:2884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61756.exe
        5⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6411.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34780.exe
        7⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        7⤵
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31354.exe
        6⤵
        
        PID:9436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26489.exe
        6⤵
        
        PID:16476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60643.exe
        5⤵
        
        PID:8040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10955.exe
        6⤵
        
        PID:9348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60419.exe
        6⤵
        
        PID:16084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1265.exe
        5⤵
        
        PID:11116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39091.exe
        5⤵
        
        PID:18212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65330.exe
      4⤵
      PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15932.exe
        5⤵
        
        PID:6328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29124.exe
        6⤵
        
        PID:11504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        6⤵
        
        PID:16856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59803.exe
        5⤵
        
        PID:12656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        5⤵
        
        PID:2468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65355.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6658.exe
        5⤵
        
        PID:12908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        5⤵
        
        PID:4356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63722.exe
      4⤵
      PID:4112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52811.exe
      4⤵
      PID:17384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9586.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9586.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50220.exe
      4⤵
      PID:3940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14091.exe
        5⤵
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15932.exe
        6⤵
        
        PID:8188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24308.exe
        7⤵
        
        PID:12008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53211.exe
        7⤵
        
        PID:16428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53747.exe
        6⤵
        
        PID:12960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        6⤵
        
        PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45755.exe
        5⤵
        
        PID:8856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37484.exe
        6⤵
        
        PID:11872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        6⤵
        
        PID:5784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60379.exe
        5⤵
        
        PID:14252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61178.exe
        5⤵
        
        PID:16944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35746.exe
      4⤵
      PID:7032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34780.exe
        5⤵
        
        PID:8272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32196.exe
        6⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        6⤵
        
        PID:17868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53467.exe
        5⤵
        
        PID:13844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30097.exe
      4⤵
      PID:10108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18322.exe
      4⤵
      PID:14728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41290.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41290.exe
    3⤵
    PID:5104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20340.exe
      4⤵
      PID:5156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
        5⤵
        
        PID:6204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26258.exe
        6⤵
        
        PID:10368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65021.exe
        6⤵
        
        PID:18184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-881.exe
        5⤵
        
        PID:12048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57229.exe
        5⤵
        
        PID:5940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34987.exe
      4⤵
      PID:8508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50260.exe
        5⤵
        
        PID:11032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        5⤵
        
        PID:916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41050.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52811.exe
      4⤵
      PID:17356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45994.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45994.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17660.exe
      4⤵
      PID:8012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47380.exe
        5⤵
        
        PID:876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        5⤵
        
        PID:16776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59803.exe
      4⤵
      PID:12672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6609.exe
      4⤵
      PID:17696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16187.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16187.exe
    3⤵
    PID:8900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47219.exe
      4⤵
      PID:14224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
      4⤵
      PID:4572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17937.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17937.exe
    3⤵
    PID:13344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43010.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43010.exe
    3⤵
    PID:17268
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13409.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13409.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12819.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12819.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40692.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49924.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44932.exe
        6⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3619.exe
        7⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15732.exe
        8⤵
        
        PID:696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33083.exe
        9⤵
        
        PID:13100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65006.exe
        9⤵
        
        PID:18040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-986.exe
        8⤵
        
        PID:10568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43002.exe
        8⤵
        
        PID:14684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55427.exe
        8⤵
        
        PID:18248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8177.exe
        7⤵
        
        PID:8336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe
        8⤵
        
        PID:11644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        8⤵
        
        PID:18136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26.exe
        7⤵
        
        PID:13148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61178.exe
        7⤵
        
        PID:16964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7978.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48796.exe
        7⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14795.exe
        8⤵
        
        PID:9560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34762.exe
        8⤵
        
        PID:15756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59803.exe
        7⤵
        
        PID:12632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        7⤵
        
        PID:17008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41339.exe
        6⤵
        
        PID:9192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15689.exe
        6⤵
        
        PID:13212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16534.exe
        6⤵
        
        PID:18356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42298.exe
        6⤵
        
        PID:13056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30074.exe
        5⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6027.exe
        6⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8770.exe
        7⤵
        
        PID:11108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5353.exe
        7⤵
        
        PID:15992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18177.exe
        6⤵
        
        PID:11636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16004.exe
        6⤵
        
        PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26321.exe
        5⤵
        
        PID:8352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24514.exe
        5⤵
        
        PID:13740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60540.exe
        5⤵
        
        PID:2176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13530.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17386.exe
        5⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38316.exe
        6⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18444.exe
        7⤵
        
        PID:8252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        7⤵
        
        PID:18412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64219.exe
        6⤵
        
        PID:10384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7553.exe
        6⤵
        
        PID:3684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32961.exe
        5⤵
        
        PID:7964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60628.exe
        6⤵
        
        PID:9812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19691.exe
        6⤵
        
        PID:9020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60851.exe
        5⤵
        
        PID:11020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4753.exe
        5⤵
        
        PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37937.exe
      4⤵
      PID:6704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8770.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39842.exe
        5⤵
        
        PID:15676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10762.exe
      4⤵
      PID:10024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18355.exe
      4⤵
      PID:14816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55205.exe
      4⤵
      PID:5660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36010.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36010.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63603.exe
      4⤵
      PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33442.exe
        5⤵
        
        PID:6684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59284.exe
        6⤵
        
        PID:9196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44938.exe
        6⤵
        
        PID:4524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36796.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11548
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 648
        5⤵
        Program crash
        
        PID:876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13545.exe
      4⤵
      PID:5684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8635.exe
        5⤵
        
        PID:8652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53628.exe
        6⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        6⤵
        
        PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6658.exe
        5⤵
        
        PID:12984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        5⤵
        
        PID:17156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32595.exe
      4⤵
      PID:8752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25865.exe
      4⤵
      PID:14048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52811.exe
      4⤵
      PID:17804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33617.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33617.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60308.exe
      4⤵
      PID:3252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20828.exe
        5⤵
        
        PID:6360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58220.exe
        6⤵
        
        PID:8720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39596.exe
        7⤵
        
        PID:11444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50243.exe
        7⤵
        
        PID:17768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13866.exe
        6⤵
        
        PID:12312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        6⤵
        
        PID:6044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54219.exe
        5⤵
        
        PID:9148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16732.exe
        6⤵
        
        PID:13692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        6⤵
        
        PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60570.exe
        5⤵
        
        PID:14160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12474.exe
        5⤵
        
        PID:17784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36514.exe
      4⤵
      PID:7516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44292.exe
        5⤵
        
        PID:9868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        5⤵
        
        PID:17668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22313.exe
      4⤵
      PID:10948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62619.exe
      4⤵
      PID:14672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36298.exe
      4⤵
      PID:10464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49867.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49867.exe
    3⤵
    PID:5328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61284.exe
      4⤵
      PID:6604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36124.exe
        5⤵
        
        PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54155.exe
        5⤵
        
        PID:14768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        5⤵
        
        PID:17932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65179.exe
      4⤵
      PID:9724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20433.exe
      4⤵
      PID:14680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22945.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22945.exe
    3⤵
    PID:7500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52372.exe
      4⤵
      PID:9372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1514.exe
      4⤵
      PID:16188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3170.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3170.exe
    3⤵
    PID:11084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22195.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22195.exe
    3⤵
    PID:2212
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28891.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28891.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13146.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13146.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26292.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14091.exe
        5⤵
        
        PID:5812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33140.exe
        6⤵
        
        PID:8632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6627.exe
        7⤵
        
        PID:11772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        7⤵
        
        PID:1056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36450.exe
        6⤵
        
        PID:9628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        6⤵
        
        PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5594.exe
        5⤵
        
        PID:8888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43082.exe
        5⤵
        
        PID:13972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16004.exe
        5⤵
        
        PID:17200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35746.exe
      4⤵
      PID:6992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43612.exe
        5⤵
        
        PID:7892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16436.exe
        6⤵
        
        PID:13172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35402.exe
        5⤵
        
        PID:13496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        5⤵
        
        PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37970.exe
      4⤵
      PID:9460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65006.exe
      4⤵
      PID:13404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4017.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4017.exe
    3⤵
    PID:4148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58331.exe
      4⤵
      PID:6416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44292.exe
        5⤵
        
        PID:9860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8810.exe
        5⤵
        
        PID:15004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63603.exe
        5⤵
        
        PID:5884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16153.exe
      4⤵
      PID:10152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3809.exe
      4⤵
      PID:17660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5658.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5658.exe
    3⤵
    PID:5712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58692.exe
      4⤵
      PID:7908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6347.exe
        5⤵
        
        PID:808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        5⤵
        
        PID:17648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59803.exe
      4⤵
      PID:12664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
      4⤵
      PID:17108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7489.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7489.exe
    3⤵
    PID:8880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25964.exe
      4⤵
      PID:14204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11218.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22402.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22402.exe
    3⤵
    PID:13364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60540.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60540.exe
    3⤵
    PID:16588
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63282.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63282.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-915.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-915.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34682.exe
      4⤵
      PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29004.exe
        5⤵
        
        PID:7824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13747.exe
        6⤵
        
        PID:12392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58411.exe
        6⤵
        
        PID:16816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12802.exe
        5⤵
        
        PID:11804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        5⤵
        
        PID:17996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44586.exe
      4⤵
      PID:7268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50836.exe
        5⤵
        
        PID:6376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27658.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:18204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13866.exe
      4⤵
      PID:12616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65006.exe
      4⤵
      PID:3544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54771.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54771.exe
    3⤵
    PID:5468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18716.exe
      4⤵
      PID:6272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15932.exe
        5⤵
        
        PID:6176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6627.exe
        6⤵
        
        PID:11792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18804.exe
        6⤵
        
        PID:18380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53747.exe
        5⤵
        
        PID:12940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6609.exe
        5⤵
        
        PID:17300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51810.exe
      4⤵
      PID:7572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24547.exe
      4⤵
      PID:13704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36761.exe
      4⤵
      PID:16152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58994.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58994.exe
    3⤵
    PID:6940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36316.exe
      4⤵
      PID:9848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
      4⤵
      PID:18272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20586.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20586.exe
    3⤵
    PID:10552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37041.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37041.exe
    3⤵
    PID:15688
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24842.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24842.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2747.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2747.exe
    3⤵
    PID:2104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43988.exe
      4⤵
      PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33140.exe
        5⤵
        
        PID:8620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22994.exe
        5⤵
        
        PID:12996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63978.exe
        5⤵
        
        PID:17140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12994.exe
      4⤵
      PID:7672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28665.exe
      4⤵
      PID:6484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57229.exe
      4⤵
      PID:5500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49587.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49587.exe
    3⤵
    PID:6632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52372.exe
      4⤵
      PID:10164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40522.exe
      4⤵
      PID:14748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39099.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21929.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21929.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:9984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60891.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60891.exe
    3⤵
    PID:14840
- C:\Users\Admin\AppData\Local\Temp\Unicorn-507.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-507.exe
  2⤵
  PID:5280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12659.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12659.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36892.exe
      4⤵
      PID:8200
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6428 -s 648
      4⤵
      Program crash
      PID:2096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2418.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2418.exe
    3⤵
    PID:10144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16004.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16004.exe
    3⤵
    PID:16396
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57585.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57585.exe
  2⤵
  PID:6200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52372.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52372.exe
    3⤵
    PID:9796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57435.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57435.exe
    3⤵
    PID:860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39099.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39099.exe
    3⤵
    PID:11492
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48818.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48818.exe
  2⤵
  PID:10348
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23266.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23266.exe
  2⤵
  PID:15760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5916 -ip 5916
1⤵
PID:7456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3892 -ip 3892
1⤵
PID:7908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 6332 -ip 6332
1⤵
PID:8932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5916 -ip 5916
1⤵
PID:7340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1636 -ip 1636
1⤵
PID:8328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5848 -ip 5848
1⤵
PID:9784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 6332 -ip 6332
1⤵
PID:9680

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1016 -s 3280
1⤵
PID:13136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 6836 -ip 6836
1⤵
PID:2476

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12274.exe

Filesize
468KB

MD5
ea385e827272bfdc5d115725ebba136a

SHA1
bd786887e40d260c02c7a8589d0e416012701cbc

SHA256
56d417571da836818dc5dd2daf0df8d10f27756053c7b1edc1e97007d993859c

SHA512
a69dc115d0ecccd481aa1f5e64049582d89aa6494d7d2ddbd3829c92e67159824b47cb53ba98d150cd2ad847e12433f438ac4420b619b41a936e580995885bf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12819.exe

Filesize
468KB

MD5
18a7cb1af1da951c82d81d6af6eb69fc

SHA1
fc4627488ef97c3d4bcc760d54bdb4c3b0f99fc6

SHA256
f9440acdb1874584dfc57009892e6eb8d42230148fd36964a19ab9f480ecaaff

SHA512
4b7b046d6be19df5ffcd56d0e9a9446062f2080487d587edbea4a2dc9e30c749b4765e999d1108985ebe7ddc5223439997e437b6693e04aa13321a8968ce26e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13146.exe

Filesize
468KB

MD5
4e4ff19509b6b66b42ccc81b184b7c75

SHA1
651ccd697d222986488ea974e8c8e159516d40b2

SHA256
d4c1fdccb9c53a2cbd00a6c43a27c287a6077615052d8ab915a7a254f0a84b7b

SHA512
008cd6a999859e565e59a75b8277197b9991354fc9352ad7a10e45cf03afbe2ee3f95c373c88b75a5cae0ff6ec549b747024208c75179774376940a7d70b91fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13409.exe

Filesize
468KB

MD5
cca97472ebbc5afd318424732274bcb5

SHA1
390c150a4547d226ab732cee5742669015d5b079

SHA256
9adbe878db6414d9fc216f227015674d5cc9461589abbc8f1c07d89eaa617a45

SHA512
1744571d484f33ebf565158e8fe3e1e8143ca6ff19c2ff6dd89b6b6d57ade71a52289679edc8368dc2ac9718c3e8f38868cf20bc6b37f1bdca27f85a5c68dcf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18802.exe

Filesize
468KB

MD5
a4ef99521c9dd4ff33fc57c8cc4d0835

SHA1
2ccb6282ac7500f1042bd847a61e666924d68306

SHA256
03201027780dced1b81a79716794604b8ce09d1aebd71afe49ff7c164ddd2d3f

SHA512
c7223a71335aec0d1e46e641cfa3c6d2731806d9e5aa145472408162c6b922e8504238fd8ae5704321fe034f3c6c55ec1fe31cccabb6abbe35ccdaf98a18f2da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19540.exe

Filesize
468KB

MD5
1f95448bbc52d0b1a6349a14fff00c96

SHA1
58051d4abbeefb700e66b5073a4ccb8b3ae08315

SHA256
6c97ecd245cb55042e711745c575d1ab8b06aa25a637ec1fe3fb092b5b54974c

SHA512
ca00c3a99950f32286e832c24b98189f6e4ac1bf42616377ec4401bc48e689cea0267c7a7cfa83b423f14e7a13fa9d0a5356f4daef4aa893bd0c337aea6b3c22

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22332.exe

Filesize
468KB

MD5
f5efddcfc13483d1c739e5c0632ce199

SHA1
e613b04361e0e796e4d6f4108eff9ba1749009ff

SHA256
6f0e0bc04d30f6b405ebd8a55bfcc74ae1ed107598467049c886c17aa80f5836

SHA512
5d55bbdca0de1595e02bdca0dfa047bb1af1aa3c19b02f51177e0d52b0094bea04eeb0fed87d0b6124fddb19116bd74214ffc75f6ef2ed296efbb202723e81de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23025.exe

Filesize
468KB

MD5
90313b6b6d727ad18afe89c2bc174dbe

SHA1
bf874e3494b36b0265e867b47b53cfe72ab07ca8

SHA256
b68839d5265808fe5ee7d30f4bf965cb88c3fdc54e69e0ad8e2bc8bf69342d9a

SHA512
b80fa564df208b289763f9f26d6d700edda3b87fb5fa37488b3f262eddb30f2b699fb723da3db85880cc3626672251c645a38da3ac853604ef11514a269e2eff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25817.exe

Filesize
468KB

MD5
61652df4731689f2ca1c66e517312ece

SHA1
f6a2fa6538721e297a0a47e9ff7260eee1a280dd

SHA256
c94c2e3cfede50da6d544bdce6b8a795660104003362f9d1b63e24dfcc76fbc1

SHA512
ed6bf129add5f31d58a396e3277d6c6d3f06069fc00dd59afb9dd4b87d3622a5abc6f17948d34828a22afbdf010f4850de04bf70311528dfe21a5ec8a90bde93

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28891.exe

Filesize
468KB

MD5
242dda551c2092e57f95cac7b8dc726f

SHA1
3520bacfa5fc46fcaa632167870a0f0cc089c9c1

SHA256
1ee1b118167b54ead2175649e18f3c9203c6be5d022e0674a4ddbf6477ea635a

SHA512
2c1f707cb93a6d5caacf37f500c5ca2655f096c0856e2005671f7c434f3858cf3397e61f97a71c09702af7323acdc4ef0fae459a6a4b0e9a764c03d97219a09d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3203.exe

Filesize
468KB

MD5
08a93311ebf69c2f4e7ce08c6f1b7be4

SHA1
bd6a1e5289e7aa9c6c52cb9fa3236481256afa6f

SHA256
3f61217608eb7a83da53f1f5a4d0859cfaf073a77868040a69b99717d3ddec8d

SHA512
4d995c1042c6c7fd3905064537e1c3e74c1140900535d88d8f60bfe08a4ed7c52e4c583151c8beff9b421c211b4ad5c5da304aa8f3e0d1c068af0e79176321e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32332.exe

Filesize
468KB

MD5
cdfc914476755b07d6de442ba3a51e15

SHA1
d218a7ca0a5fbfd2208ba353ca1a47efa943748b

SHA256
5df5ca553b23e7be1b79d2eb65ba77a1aa415bccc099f83faaa0fa86e14a709b

SHA512
ec4b5e47d1931173b5b6339796be2e9a608b0a23665fb858ac0454a25af5db7a202280582923025ccb7ed3a331c71d301023558f95071ed2a653a2c5072b1d9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32628.exe

Filesize
468KB

MD5
127bafc461bbffdee6efff0ef12b147f

SHA1
d1ebf748d3042cb5c2eadf9af9454fd5e2ce9bf7

SHA256
4680dc6eb2dd48811a07f4eeea1fef512d3bdd55e89a409bc32c0e58bb88d714

SHA512
8b7370629a5075db203dc492ef7ab9130ef95ea8ee6d1a5022e7b3302a0c05dcbf15f009a8b33f0adf3acfeb25551aae6a41013a3dcb2658563236a2ad6b3d8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36010.exe

Filesize
468KB

MD5
e9237a7d222ce1865b10ed352d04ccb8

SHA1
61ad7617c847ef95692e752d8b4e9cd84be62c13

SHA256
90769cd22d1df018481a6172fbedf3122d01ca49f91c4e9120989d07e8c39ae7

SHA512
b0c2573cf871a442ef3feaaf046b32546caa715ddc05967a8956e71dad734541d252e0f3f75cff2eca85f1fba7b916780cc532a4c30637eca47c953b18ac05d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37354.exe

Filesize
468KB

MD5
f4ea931f60bd3eda15a68c58ca706604

SHA1
917ff4386c7c8f5f7e46e6e71a749e4384743909

SHA256
980f7e35243cb88da42801cdb249b2aa5d240c8d1bb4549ac96d82e5c09aa317

SHA512
d2ed1d0571a54d37fcf82f2d0316a9d3ff760b3f0f210a4a795fe548f5f6d9c73259b2afa38531ade6c1ba96ff01ee03d1debd0a72412847f8ff7134a5957592

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40692.exe

Filesize
468KB

MD5
b68c8f53365adb97be7a82a5cd8115c4

SHA1
d6eef9f4dbe20a901dd8bbf505f00d21a78d7ca4

SHA256
b43f12f82db3dfc646d38bcc4880afcb73783e4e1928858f14bd8e97688c82f7

SHA512
3589f4c6eacc0fc5a3ef9ae29b695797441a55dd3a80563ef25dbe9704af9bb96f1b3757ae4fadab34b97d752ccef63aa6550fb7c1e8bbc0bd2f9bfb723aca72

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4786.exe

Filesize
468KB

MD5
60ce0309c06d6320e5104886f92ecc8e

SHA1
4f378c2099cf87c08130cc5166c9cbe3c7096fde

SHA256
f4a2be5f1c0cd25ba6b8a8c585db971b2547ffb88e0a4968413bfbf841c5e635

SHA512
0d62f7c308daa1a168191ddef04d0872bf7d446e978f14e7be97a405fb4452bca23a53d7e836dc171ed69b6f4a8640c7d4cee5dde62c6f09f48849d3ecd63d05

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49746.exe

Filesize
468KB

MD5
086d86005cc3957472376c73b970a17b

SHA1
81f6c46d26ca7f71dcd23999908ac439034264a5

SHA256
73f6b4d987d743c0071f3f6352a067ca3bd70d47d6fc3f788343da0524dabd1e

SHA512
fdfa4dcf3bd1d00e17e8cdf7e363699e5184339b2f084981aaedccbb7aef8e7e7e0e2b5148b37ade40e8f352684abd36ebe8f3ba69856d71ebb19c6b51451933

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52051.exe

Filesize
468KB

MD5
0a2055de398fe4517972bb55deb0381e

SHA1
71e92bc4308ee1b4a770a62e41394a258ce047f6

SHA256
df3e89f6910dceb658b9e204fe5845c8f0fa7aad42cd600cac9b561786552e7a

SHA512
f7bba743421ba499d6ba7fbce7be49512714738ccd09073acc896b0362abcd0425ab480d01994e62b9e40871707b79a833a4cade36a8fd560ebfa32300f75f79

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52347.exe

Filesize
468KB

MD5
a55d0f2ff80046a671e7f60d8b2615f9

SHA1
c0adc156e462e011043180a760d85719554f74c3

SHA256
84cfd9709650ad53b24f31bed655bc1b827c9d824d1ffec9e14f7800be0d53e9

SHA512
20baa3654c3f7898c3356a5ee97ffcdd7f35b97dd567588b47027c76e8dfa773d3a82ea26ea80f567bcf75df16d5cee0406c0ed1eaa604f65c279d82afe628e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53852.exe

Filesize
468KB

MD5
89b5614e7785a12f9daab8aee1db6621

SHA1
2e7e0b7c28f67412113ac1d2ddec0072a08caee1

SHA256
5ba658fbca51453c65f6f2d06a0c2bcc1449a40c130064a2ca3e50fd287877b0

SHA512
02d493e49daa254319393c1a99be42707cca47f4ae6e641943039b22fd524567b16a8646520f27eb2a064ae309cf175bb7f3dfa2c1696249b65878ffcf75a03f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55611.exe

Filesize
468KB

MD5
a13ff6cc4de61fc6f6bd6bc383758cac

SHA1
aaf7899c9bb97fbbb3f89dab6ff35ea8c9d060fc

SHA256
4a551f8e7ba76cb9b160a572099840ada25ea3fefc530faf95a54875895671be

SHA512
a437d43e4a1fd31b38c1491581845dc801c5e2623fafb14163223bd6519781dc6a7b69831053c20158193c578379d0a73495a5ae009bbe956c3157c32ee32585

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55974.exe

Filesize
468KB

MD5
498a711aa062a48d10db93c13d269226

SHA1
f6d8dee94acb2b600ca4d04d8b0b1745a80a2e54

SHA256
a5283402e24f5653e19ea1a9fe8503a61ce380f89fb96798eca6ed2f6e88fd59

SHA512
61b31621322b2bb6b2854fc74df73b368f11b1554bd129f645ce253a8fa150e6d8a12e9f87bc29814010b4b8208205954056aac274239bc1e4e80f5b2b1f59d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe

Filesize
468KB

MD5
9274d17c885d4e1d877045e2e00d36ac

SHA1
1c6b4a6949fbaf959d98e6ee2b4832161a7e9f65

SHA256
23b3b2e6f7c019577d30abe0b2f01c014ae1737c5b29b435f135d4552ab913cc

SHA512
3598481d7e8237705be612e1a62efde21ef60ccba6cf0b64266779e2bddc4c9ddfee3216b4a1f1a88ce254c6ccd757ca334d316625a8ac752129b43b767ebbef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58491.exe

Filesize
468KB

MD5
e4a1d65fbfd134d2ff7a136c5e03310b

SHA1
2e99a20f28f09488144923dab5c1ef8fb9a47029

SHA256
844804228eada52fe2240c274131ce6e670f8ede0971094afca0f5f3cd632a59

SHA512
ad9eb681c8494f847aac8038ed0670ec39198734e990041e49b83733916fde1945f6a8c8f3b8700edeb96350065dab74659a1941786840a67b6dd2018b775222

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58774.exe

Filesize
468KB

MD5
806f4c6c8b3ca3aa5fcb010b62122fae

SHA1
6503b475b8c5a3e559d40b0348a626df4e1476ec

SHA256
91901ba2ef76da31f1b605cc478d23c4f3560a63a501816e74dfd86ab64fa903

SHA512
0d9b65a76e7cac48749e314e646b26f74158d1c919df7210f8440da14cbdf05295676f6267d2f5875a324014b287a276b9092a3ebd4ac76bf3a752d169a91395

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63068.exe

Filesize
468KB

MD5
f04a104506eb4be1d98073b8c1f1b7a8

SHA1
2849b8e6a8f9c135a8139871aa1afdd8f77154f5

SHA256
5d62eee31eaf639fb040b76c51b31dbe84f74b82709eec4025312e44b312915e

SHA512
9a462190c9fa9a1cbb6f270b572258991aa3f14672f32c423050c5a5260c855fd7e211f88b2298d09ac62be3a9c76e107ee818bb5f70af0e8246a824135596c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63282.exe

Filesize
468KB

MD5
25ec5510497d8a511121b65d77910d4b

SHA1
2afc1508b064e86de7358721bba49ed82b4c1916

SHA256
6c6062642e4456908f56ebe67f2b8fd5ae7eef72a4ef9ce5db6547c51a9e9c91

SHA512
c66495ad2dc20d99a24ffec88d5b52d08866e6a40dad400128e724cb7ccfcc549037a75fddf59011e44eca3e0bcced036daaea00eef46d5f99479f8214a11301

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6379.exe

Filesize
468KB

MD5
ef5df0fb7991fa5cc3a4b9290150632b

SHA1
9fd78c855a7a67895038d2ea76ecb3adc03343ae

SHA256
fc752a206f6671ad6b6b428ef0c9d337321b33c1e61cd6e55a5791e99b88d3f6

SHA512
41a2b1324a0ab4671dc10643bf9ad9b875ac2e2e2f3f1c6f9ce079137dbece345486deb295b6763d2e9a9f2e3116a1f3a83e42d8305c9e3d4d42a0c5407f0372

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65004.exe

Filesize
468KB

MD5
d01b13c2def9aee18cdcaeac7e20912e

SHA1
967271217e7710c5161a709dc44de4982d3d11d3

SHA256
c23d8754de9257dd7e5cbf10c20e1db7937620dd398ff65233ee114037ba707e

SHA512
cf58dcbb1b000adc568166087edbfd60a3a83410fc7b09984533d9d0e86319feb8d107a624e891777d3d67f31633964bf31a9fc49ee5577eba2b18a46bf1df74

Download Submit
memory/212-417-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/220-377-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/748-61-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/760-316-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/924-233-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1060-273-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1084-180-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1112-214-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1248-454-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1256-128-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1300-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1352-267-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1392-45-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1480-255-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1504-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1520-445-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1524-440-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1820-174-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1856-101-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1872-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1936-22-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1960-178-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2104-491-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2116-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2160-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2312-271-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2384-379-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2428-342-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2440-84-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2480-95-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2520-227-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2588-176-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2636-313-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2708-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2836-307-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2856-41-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2876-39-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2884-384-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2892-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2952-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3076-230-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3096-335-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3180-343-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3252-459-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3292-450-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3320-106-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3456-116-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3512-200-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3584-242-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3600-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3664-97-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3740-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3752-23-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3892-426-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3916-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3932-139-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3940-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3996-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4012-179-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4108-175-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4136-150-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4148-387-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4248-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4328-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4332-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4340-87-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4436-314-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4552-281-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4564-492-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4584-458-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4700-350-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4780-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4800-224-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4856-207-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4912-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4948-355-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5060-301-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5104-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5128-495-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5140-497-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5148-512-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5160-513-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5200-528-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5212-509-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5240-530-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5252-510-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5280-541-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5292-511-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5320-515-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5328-514-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5352-516-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5372-517-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5424-518-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5440-521-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5448-524-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5460-525-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads