88bfc90c2a6ee15ff65565416978c085996e67aec8edf3099ff35fd7c5274d0f

Analysis

max time kernel
120s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 07:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2df5dbd778f90c515ae4fd26162a4070N.exe
Size

468KB
MD5

2df5dbd778f90c515ae4fd26162a4070
SHA1

6f048eab62359c26d48e2bcc219a40b024c1feec
SHA256

88bfc90c2a6ee15ff65565416978c085996e67aec8edf3099ff35fd7c5274d0f
SHA512

b90dd08359bb2fbe4c9b1ae784030b802f1ae9fe99c370febe7b2ed9623397f77d7c46a85487b3147533d3c66b4b1e41fcf94fe2950ee3185f25769b2da94332
SSDEEP

3072:z4/iogxxj28U2bY3Pa37qf8/ECqjyIpdymHxw/HU3Bs+J3zNVNla:z4qoqXU2APQ7qfG01x3BLpzNV

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4860	Unicorn-561.exe
1120	Unicorn-25746.exe
1692	Unicorn-63249.exe
2336	Unicorn-44874.exe
2736	Unicorn-55080.exe
1264	Unicorn-41344.exe
2224	Unicorn-21146.exe
1960	Unicorn-33952.exe
3512	Unicorn-19994.exe
3628	Unicorn-19994.exe
1560	Unicorn-36065.exe
2572	Unicorn-13863.exe
1048	Unicorn-4721.exe
3532	Unicorn-33864.exe
4904	Unicorn-14617.exe
524	Unicorn-16847.exe
4124	Unicorn-15001.exe
660	Unicorn-6263.exe
4616	Unicorn-23362.exe
2176	Unicorn-14928.exe
4160	Unicorn-60865.exe
4072	Unicorn-60865.exe
2100	Unicorn-6937.exe
2380	Unicorn-52801.exe
2928	Unicorn-11960.exe
3848	Unicorn-11960.exe
3452	Unicorn-22506.exe
620	Unicorn-27528.exe
4664	Unicorn-305.exe
3388	Unicorn-8473.exe
2628	Unicorn-8473.exe
2088	Unicorn-43184.exe
1820	Unicorn-2919.exe
4300	Unicorn-8784.exe
3548	Unicorn-41722.exe
3352	Unicorn-7705.exe
4788	Unicorn-17911.exe
1160	Unicorn-24042.exe
1052	Unicorn-14912.exe
3408	Unicorn-53569.exe
2824	Unicorn-53569.exe
1432	Unicorn-15303.exe
2080	Unicorn-15874.exe
2496	Unicorn-11929.exe
540	Unicorn-57793.exe
608	Unicorn-10777.exe
1912	Unicorn-13007.exe
2208	Unicorn-11161.exe
2316	Unicorn-62592.exe
4312	Unicorn-19522.exe
392	Unicorn-7824.exe
2516	Unicorn-10999.exe
4812	Unicorn-50186.exe
1308	Unicorn-60392.exe
924	Unicorn-62033.exe
3480	Unicorn-8577.exe
3864	Unicorn-8577.exe
1284	Unicorn-33082.exe
3700	Unicorn-19050.exe
4624	Unicorn-43481.exe
3584	Unicorn-39256.exe
4484	Unicorn-39256.exe
3560	Unicorn-59122.exe
3292	Unicorn-42786.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
2076	1692	WerFault.exe	93
8640	7852	WerFault.exe	354
8704	7836	WerFault.exe	356
8628	7844	WerFault.exe	355

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55962.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44369.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60901.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20978.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44874.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35314.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33707.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53258.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10059.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61580.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6937.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63780.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29779.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21789.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23322.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55644.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7010.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20210.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11082.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55962.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50306.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15346.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27860.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39972.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55644.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11929.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43481.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39256.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58299.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4866.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60865.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42786.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23895.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46293.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33952.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13691.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46051.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62644.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10595.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11211.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62005.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51385.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25539.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6037.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12456.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7705.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4457.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39555.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4794.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36117.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64619.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3444.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23362.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57252.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3651.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42555.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4636.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62196.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35314.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	1420	dwm.exe
Token: SeChangeNotifyPrivilege	1420	dwm.exe
Token: 33	1420	dwm.exe
Token: SeIncBasePriorityPrivilege	1420	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
544	2df5dbd778f90c515ae4fd26162a4070N.exe
4860	Unicorn-561.exe
1120	Unicorn-25746.exe
1692	Unicorn-63249.exe
2336	Unicorn-44874.exe
1264	Unicorn-41344.exe
2736	Unicorn-55080.exe
2224	Unicorn-21146.exe
1960	Unicorn-33952.exe
1560	Unicorn-36065.exe
3512	Unicorn-19994.exe
2572	Unicorn-13863.exe
3628	Unicorn-19994.exe
1048	Unicorn-4721.exe
3532	Unicorn-33864.exe
4904	Unicorn-14617.exe
524	Unicorn-16847.exe
4124	Unicorn-15001.exe
4072	Unicorn-60865.exe
2176	Unicorn-14928.exe
4160	Unicorn-60865.exe
4616	Unicorn-23362.exe
660	Unicorn-6263.exe
2100	Unicorn-6937.exe
2380	Unicorn-52801.exe
2928	Unicorn-11960.exe
3848	Unicorn-11960.exe
3452	Unicorn-22506.exe
620	Unicorn-27528.exe
2628	Unicorn-8473.exe
4664	Unicorn-305.exe
3388	Unicorn-8473.exe
2088	Unicorn-43184.exe
3352	Unicorn-7705.exe
3548	Unicorn-41722.exe
1820	Unicorn-2919.exe
4788	Unicorn-17911.exe
1432	Unicorn-15303.exe
1052	Unicorn-14912.exe
1160	Unicorn-24042.exe
3408	Unicorn-53569.exe
2824	Unicorn-53569.exe
4300	Unicorn-8784.exe
2080	Unicorn-15874.exe
2496	Unicorn-11929.exe
540	Unicorn-57793.exe
608	Unicorn-10777.exe
1912	Unicorn-13007.exe
2208	Unicorn-11161.exe
2316	Unicorn-62592.exe
392	Unicorn-7824.exe
4312	Unicorn-19522.exe
2516	Unicorn-10999.exe
4812	Unicorn-50186.exe
1308	Unicorn-60392.exe
924	Unicorn-62033.exe
3864	Unicorn-8577.exe
1284	Unicorn-33082.exe
3480	Unicorn-8577.exe
3700	Unicorn-19050.exe
4624	Unicorn-43481.exe
3584	Unicorn-39256.exe
3560	Unicorn-59122.exe
4484	Unicorn-39256.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 544 wrote to memory of 4860	544	2df5dbd778f90c515ae4fd26162a4070N.exe	90
PID 544 wrote to memory of 4860	544	2df5dbd778f90c515ae4fd26162a4070N.exe	90
PID 544 wrote to memory of 4860	544	2df5dbd778f90c515ae4fd26162a4070N.exe	90
PID 4860 wrote to memory of 1120	4860	Unicorn-561.exe	92
PID 4860 wrote to memory of 1120	4860	Unicorn-561.exe	92
PID 4860 wrote to memory of 1120	4860	Unicorn-561.exe	92
PID 544 wrote to memory of 1692	544	2df5dbd778f90c515ae4fd26162a4070N.exe	93
PID 544 wrote to memory of 1692	544	2df5dbd778f90c515ae4fd26162a4070N.exe	93
PID 544 wrote to memory of 1692	544	2df5dbd778f90c515ae4fd26162a4070N.exe	93
PID 1120 wrote to memory of 2336	1120	Unicorn-25746.exe	96
PID 1120 wrote to memory of 2336	1120	Unicorn-25746.exe	96
PID 1120 wrote to memory of 2336	1120	Unicorn-25746.exe	96
PID 544 wrote to memory of 2736	544	2df5dbd778f90c515ae4fd26162a4070N.exe	98
PID 544 wrote to memory of 2736	544	2df5dbd778f90c515ae4fd26162a4070N.exe	98
PID 544 wrote to memory of 2736	544	2df5dbd778f90c515ae4fd26162a4070N.exe	98
PID 4860 wrote to memory of 1264	4860	Unicorn-561.exe	99
PID 4860 wrote to memory of 1264	4860	Unicorn-561.exe	99
PID 4860 wrote to memory of 1264	4860	Unicorn-561.exe	99
PID 2336 wrote to memory of 2224	2336	Unicorn-44874.exe	102
PID 2336 wrote to memory of 2224	2336	Unicorn-44874.exe	102
PID 2336 wrote to memory of 2224	2336	Unicorn-44874.exe	102
PID 1120 wrote to memory of 1960	1120	Unicorn-25746.exe	103
PID 1120 wrote to memory of 1960	1120	Unicorn-25746.exe	103
PID 1120 wrote to memory of 1960	1120	Unicorn-25746.exe	103
PID 1264 wrote to memory of 3512	1264	Unicorn-41344.exe	104
PID 1264 wrote to memory of 3512	1264	Unicorn-41344.exe	104
PID 1264 wrote to memory of 3512	1264	Unicorn-41344.exe	104
PID 2736 wrote to memory of 3628	2736	Unicorn-55080.exe	105
PID 2736 wrote to memory of 3628	2736	Unicorn-55080.exe	105
PID 2736 wrote to memory of 3628	2736	Unicorn-55080.exe	105
PID 544 wrote to memory of 1560	544	2df5dbd778f90c515ae4fd26162a4070N.exe	106
PID 544 wrote to memory of 1560	544	2df5dbd778f90c515ae4fd26162a4070N.exe	106
PID 544 wrote to memory of 1560	544	2df5dbd778f90c515ae4fd26162a4070N.exe	106
PID 4860 wrote to memory of 2572	4860	Unicorn-561.exe	107
PID 4860 wrote to memory of 2572	4860	Unicorn-561.exe	107
PID 4860 wrote to memory of 2572	4860	Unicorn-561.exe	107
PID 2224 wrote to memory of 1048	2224	Unicorn-21146.exe	108
PID 2224 wrote to memory of 1048	2224	Unicorn-21146.exe	108
PID 2224 wrote to memory of 1048	2224	Unicorn-21146.exe	108
PID 2336 wrote to memory of 3532	2336	Unicorn-44874.exe	109
PID 2336 wrote to memory of 3532	2336	Unicorn-44874.exe	109
PID 2336 wrote to memory of 3532	2336	Unicorn-44874.exe	109
PID 1960 wrote to memory of 4904	1960	Unicorn-33952.exe	110
PID 1960 wrote to memory of 4904	1960	Unicorn-33952.exe	110
PID 1960 wrote to memory of 4904	1960	Unicorn-33952.exe	110
PID 1120 wrote to memory of 524	1120	Unicorn-25746.exe	111
PID 1120 wrote to memory of 524	1120	Unicorn-25746.exe	111
PID 1120 wrote to memory of 524	1120	Unicorn-25746.exe	111
PID 2572 wrote to memory of 4124	2572	Unicorn-13863.exe	112
PID 2572 wrote to memory of 4124	2572	Unicorn-13863.exe	112
PID 2572 wrote to memory of 4124	2572	Unicorn-13863.exe	112
PID 3628 wrote to memory of 4616	3628	Unicorn-19994.exe	114
PID 3628 wrote to memory of 4616	3628	Unicorn-19994.exe	114
PID 3628 wrote to memory of 4616	3628	Unicorn-19994.exe	114
PID 544 wrote to memory of 660	544	2df5dbd778f90c515ae4fd26162a4070N.exe	113
PID 544 wrote to memory of 660	544	2df5dbd778f90c515ae4fd26162a4070N.exe	113
PID 544 wrote to memory of 660	544	2df5dbd778f90c515ae4fd26162a4070N.exe	113
PID 4860 wrote to memory of 2176	4860	Unicorn-561.exe	115
PID 4860 wrote to memory of 2176	4860	Unicorn-561.exe	115
PID 4860 wrote to memory of 2176	4860	Unicorn-561.exe	115
PID 1264 wrote to memory of 4072	1264	Unicorn-41344.exe	116
PID 1264 wrote to memory of 4072	1264	Unicorn-41344.exe	116
PID 1264 wrote to memory of 4072	1264	Unicorn-41344.exe	116
PID 2736 wrote to memory of 4160	2736	Unicorn-55080.exe	117

C:\Users\Admin\AppData\Local\Temp\2df5dbd778f90c515ae4fd26162a4070N.exe
"C:\Users\Admin\AppData\Local\Temp\2df5dbd778f90c515ae4fd26162a4070N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:544
- C:\Users\Admin\AppData\Local\Temp\Unicorn-561.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-561.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25746.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25746.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44874.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21146.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4721.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6937.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11929.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11265.exe
        9⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55962.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63274.exe
        11⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29298.exe
        11⤵
        
        PID:10360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51092.exe
        10⤵
        
        PID:8880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36324.exe
        10⤵
        
        PID:12192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45667.exe
        10⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39322.exe
        10⤵
        
        PID:9092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3528.exe
        9⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37237.exe
        10⤵
        
        PID:9340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34107.exe
        10⤵
        
        PID:12588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20707.exe
        10⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31874.exe
        9⤵
        
        PID:9968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46308.exe
        9⤵
        
        PID:13120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11843.exe
        9⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65105.exe
        8⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6377.exe
        9⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22242.exe
        10⤵
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17475.exe
        10⤵
        
        PID:10768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36235.exe
        10⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36333.exe
        10⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1891.exe
        9⤵
        
        PID:8936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52747.exe
        9⤵
        
        PID:11924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53644.exe
        9⤵
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17263.exe
        8⤵
        
        PID:8
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42837.exe
        9⤵
        
        PID:14740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49104.exe
        9⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21211.exe
        8⤵
        
        PID:10020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60523.exe
        8⤵
        
        PID:12140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12572.exe
        8⤵
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57793.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27794.exe
        8⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13777.exe
        9⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63274.exe
        10⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40059.exe
        10⤵
        
        PID:11964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12810.exe
        10⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51092.exe
        9⤵
        
        PID:8872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44579.exe
        9⤵
        
        PID:12004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62084.exe
        9⤵
        
        PID:15832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35274.exe
        9⤵
        
        PID:16036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20011.exe
        9⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20440.exe
        8⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13588.exe
        9⤵
        
        PID:9104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6338.exe
        9⤵
        
        PID:12508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20210.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:16124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5258.exe
        8⤵
        
        PID:9496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4315.exe
        8⤵
        
        PID:12788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37556.exe
        8⤵
        
        PID:15636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22047.exe
        7⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4457.exe
        8⤵
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45301.exe
        9⤵
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41508.exe
        9⤵
        
        PID:12852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36546.exe
        9⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11211.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12203.exe
        8⤵
        
        PID:13464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60355.exe
        8⤵
        
        PID:15608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62388.exe
        8⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57809.exe
        7⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24685.exe
        8⤵
        
        PID:15020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34163.exe
        8⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4762.exe
        7⤵
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63292.exe
        7⤵
        
        PID:12984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56578.exe
        7⤵
        
        PID:16200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52801.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10777.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28178.exe
        8⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44369.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28421.exe
        10⤵
        
        PID:11532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56067.exe
        10⤵
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31874.exe
        9⤵
        
        PID:9976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5275.exe
        9⤵
        
        PID:13136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45475.exe
        9⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28119.exe
        8⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6515.exe
        8⤵
        
        PID:9504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29298.exe
        8⤵
        
        PID:10492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44188.exe
        8⤵
        
        PID:15000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19913.exe
        8⤵
        
        PID:10548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59625.exe
        7⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55962.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44341.exe
        9⤵
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63132.exe
        9⤵
        
        PID:11644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62203.exe
        9⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34947.exe
        8⤵
        
        PID:8676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22186.exe
        8⤵
        
        PID:9412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61812.exe
        8⤵
        
        PID:15676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18887.exe
        7⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53117.exe
        8⤵
        
        PID:12352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65372.exe
        8⤵
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20647.exe
        8⤵
        
        PID:10076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13427.exe
        7⤵
        
        PID:9580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14579.exe
        7⤵
        
        PID:14304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13007.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62770.exe
        7⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6377.exe
        8⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13588.exe
        9⤵
        
        PID:8976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46293.exe
        10⤵
        
        PID:13532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24339.exe
        10⤵
        
        PID:16092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63323.exe
        9⤵
        
        PID:12164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3931.exe
        9⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11211.exe
        8⤵
        
        PID:8308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12203.exe
        8⤵
        
        PID:12484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28371.exe
        8⤵
        
        PID:15984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54545.exe
        7⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48979.exe
        7⤵
        
        PID:9692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22956.exe
        7⤵
        
        PID:12888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25439.exe
        7⤵
        
        PID:10560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21664.exe
        6⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39818.exe
        7⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22242.exe
        8⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33707.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45437.exe
        8⤵
        
        PID:16140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10059.exe
        7⤵
        
        PID:8944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52747.exe
        7⤵
        
        PID:11932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45475.exe
        7⤵
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23207.exe
        6⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59453.exe
        7⤵
        
        PID:11704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65452.exe
        7⤵
        
        PID:15152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6483.exe
        6⤵
        
        PID:10164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43949.exe
        6⤵
        
        PID:13184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10595.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33864.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8473.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8577.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10217.exe
        8⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1489.exe
        9⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33619.exe
        9⤵
        
        PID:11240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9618.exe
        9⤵
        
        PID:15156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2288.exe
        9⤵
        
        PID:8216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51001.exe
        8⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31210.exe
        8⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33740.exe
        8⤵
        
        PID:14640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31960.exe
        7⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41354.exe
        8⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35805.exe
        9⤵
        
        PID:11176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3859.exe
        9⤵
        
        PID:15256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31427.exe
        9⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16027.exe
        8⤵
        
        PID:9396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56011.exe
        8⤵
        
        PID:12024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2419.exe
        8⤵
        
        PID:16080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35586.exe
        8⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50128.exe
        7⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9780.exe
        8⤵
        
        PID:14604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37740.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37642.exe
        7⤵
        
        PID:13088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37845.exe
        7⤵
        
        PID:4648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39256.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14057.exe
        7⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27146.exe
        8⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15259.exe
        8⤵
        
        PID:10404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49779.exe
        8⤵
        
        PID:13780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53437.exe
        8⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63780.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7844
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7844 -s 184
        8⤵
        Program crash
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35435.exe
        7⤵
        
        PID:10352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55644.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17159.exe
        6⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42053.exe
        7⤵
        
        PID:11140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46044.exe
        7⤵
        
        PID:15004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64619.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55124.exe
        6⤵
        
        PID:8000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34762.exe
        6⤵
        
        PID:10884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20740.exe
        6⤵
        
        PID:16132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2919.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59122.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20114.exe
        7⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48474.exe
        8⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20637.exe
        9⤵
        
        PID:12284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12083.exe
        8⤵
        
        PID:10172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46219.exe
        8⤵
        
        PID:13244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36546.exe
        8⤵
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14960.exe
        7⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36957.exe
        8⤵
        
        PID:11340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15675.exe
        8⤵
        
        PID:14804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57827.exe
        7⤵
        
        PID:9756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5483.exe
        7⤵
        
        PID:12896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41576.exe
        6⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29450.exe
        7⤵
        
        PID:8160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17475.exe
        7⤵
        
        PID:10776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36235.exe
        7⤵
        
        PID:14340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9103.exe
        7⤵
        
        PID:9056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22450.exe
        6⤵
        
        PID:8996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27860.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3642.exe
        6⤵
        
        PID:15688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42521.exe
        5⤵
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61826.exe
        6⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29450.exe
        7⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64563.exe
        7⤵
        
        PID:12320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11082.exe
        7⤵
        
        PID:2844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17267.exe
        6⤵
        
        PID:9072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12203.exe
        6⤵
        
        PID:13456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46051.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14463.exe
        5⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53309.exe
        6⤵
        
        PID:12800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65372.exe
        6⤵
        
        PID:4944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7826.exe
        6⤵
        
        PID:580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42081.exe
        6⤵
        
        PID:8968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12539.exe
        5⤵
        
        PID:9960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62677.exe
        5⤵
        
        PID:13104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10211.exe
        5⤵
        
        PID:2708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33952.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14617.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22506.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57513.exe
        7⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39818.exe
        8⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42997.exe
        9⤵
        
        PID:7796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56308.exe
        9⤵
        
        PID:11520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43260.exe
        9⤵
        
        PID:16004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62011.exe
        9⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23322.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47460.exe
        8⤵
        
        PID:12960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62196.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26007.exe
        7⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60901.exe
        8⤵
        
        PID:13424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-147.exe
        8⤵
        
        PID:15520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15338.exe
        7⤵
        
        PID:9876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7563.exe
        7⤵
        
        PID:12812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5364.exe
        7⤵
        
        PID:5184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7824.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54026.exe
        7⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50674.exe
        8⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21789.exe
        9⤵
        
        PID:13624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65372.exe
        9⤵
        
        PID:15968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57252.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17090.exe
        8⤵
        
        PID:12924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46172.exe
        8⤵
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30144.exe
        7⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46293.exe
        8⤵
        
        PID:13568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30467.exe
        8⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7090.exe
        7⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39972.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18938.exe
        7⤵
        
        PID:3632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5431.exe
        6⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1961.exe
        7⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27445.exe
        8⤵
        
        PID:11080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46251.exe
        8⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3443.exe
        7⤵
        
        PID:9688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7594.exe
        7⤵
        
        PID:14300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13691.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51385.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62629.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40691.exe
        7⤵
        
        PID:4696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26194.exe
        6⤵
        
        PID:10396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30443.exe
        6⤵
        
        PID:2084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27528.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50186.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42048.exe
        7⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13588.exe
        8⤵
        
        PID:8860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47180.exe
        8⤵
        
        PID:12016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12690.exe
        8⤵
        
        PID:15524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64435.exe
        7⤵
        
        PID:9592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61668.exe
        7⤵
        
        PID:14064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11300.exe
        7⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32266.exe
        7⤵
        
        PID:6296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57233.exe
        6⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7721.exe
        7⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44341.exe
        8⤵
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63132.exe
        8⤵
        
        PID:11636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53348.exe
        8⤵
        
        PID:16268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20978.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41299.exe
        7⤵
        
        PID:9244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52084.exe
        7⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54220.exe
        7⤵
        
        PID:5588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43880.exe
        6⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42053.exe
        7⤵
        
        PID:11004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28939.exe
        7⤵
        
        PID:14908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23010.exe
        7⤵
        
        PID:16060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20072.exe
        7⤵
        
        PID:11280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12955.exe
        6⤵
        
        PID:8548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47259.exe
        6⤵
        
        PID:14180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37883.exe
        6⤵
        
        PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60392.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12640.exe
        6⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54914.exe
        7⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44035.exe
        7⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23410.exe
        6⤵
        
        PID:8752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50444.exe
        6⤵
        
        PID:11892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9698.exe
        6⤵
        
        PID:15476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37845.exe
        6⤵
        
        PID:12448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11296.exe
        5⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24634.exe
        6⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13588.exe
        7⤵
        
        PID:8908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30458.exe
        7⤵
        
        PID:12184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53843.exe
        7⤵
        
        PID:13772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25539.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47843.exe
        6⤵
        
        PID:11540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8303.exe
        5⤵
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7636.exe
        6⤵
        
        PID:9436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1731.exe
        6⤵
        
        PID:14044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61605.exe
        6⤵
        
        PID:15772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28299.exe
        5⤵
        
        PID:9800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14820.exe
        5⤵
        
        PID:12972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32042.exe
        5⤵
        
        PID:16304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34907.exe
        5⤵
        
        PID:16048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8473.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8577.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18386.exe
        7⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24634.exe
        8⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43957.exe
        9⤵
        
        PID:8608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54964.exe
        9⤵
        
        PID:11612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45939.exe
        9⤵
        
        PID:1424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58020.exe
        8⤵
        
        PID:9320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31506.exe
        8⤵
        
        PID:11560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35476.exe
        8⤵
        
        PID:16104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37314.exe
        8⤵
        
        PID:15292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63096.exe
        7⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22525.exe
        8⤵
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23827.exe
        8⤵
        
        PID:11336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33799.exe
        8⤵
        
        PID:8604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31684.exe
        7⤵
        
        PID:10156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43419.exe
        7⤵
        
        PID:13148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29869.exe
        7⤵
        
        PID:15872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6688.exe
        6⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35314.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54284.exe
        7⤵
        
        PID:10832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12202.exe
        7⤵
        
        PID:14664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36333.exe
        7⤵
        
        PID:2392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23895.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37076.exe
        6⤵
        
        PID:9764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25074.exe
        6⤵
        
        PID:15340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35828.exe
        6⤵
        
        PID:15856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63761.exe
        5⤵
        
        PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55592.exe
        5⤵
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20026.exe
        6⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49437.exe
        7⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59868.exe
        7⤵
        
        PID:13808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4947.exe
        7⤵
        
        PID:1740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27370.exe
        6⤵
        
        PID:10964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48540.exe
        6⤵
        
        PID:14924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5064.exe
        5⤵
        
        PID:7700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28410.exe
        5⤵
        
        PID:8804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8539.exe
        5⤵
        
        PID:15312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28909.exe
        5⤵
        
        PID:2188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8784.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53258.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44369.exe
        6⤵
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30901.exe
        7⤵
        
        PID:9720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44492.exe
        7⤵
        
        PID:14160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63084.exe
        7⤵
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31874.exe
        6⤵
        
        PID:9992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46308.exe
        6⤵
        
        PID:13128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45475.exe
        6⤵
        
        PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60897.exe
        5⤵
        
        PID:6460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21789.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55164.exe
        6⤵
        
        PID:15512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15346.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3651.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60333.exe
        5⤵
        
        PID:5744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36159.exe
      4⤵
      PID:972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28578.exe
        5⤵
        
        PID:5244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6764.exe
        6⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4636.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8259.exe
        6⤵
        
        PID:12168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13883.exe
        6⤵
        
        PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11211.exe
        5⤵
        
        PID:8284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12203.exe
        5⤵
        
        PID:11732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28563.exe
        5⤵
        
        PID:14868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7720.exe
      4⤵
      PID:7020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14092.exe
        5⤵
        
        PID:13172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5292.exe
      4⤵
      PID:9604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58826.exe
      4⤵
      PID:12904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24115.exe
      4⤵
      PID:5320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41344.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41344.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19994.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19522.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11561.exe
        7⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35314.exe
        8⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
        9⤵
        
        PID:12784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29779.exe
        8⤵
        
        PID:10868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12202.exe
        8⤵
        
        PID:14656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33415.exe
        8⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51001.exe
        7⤵
        
        PID:7720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31210.exe
        7⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15675.exe
        7⤵
        
        PID:15228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57233.exe
        6⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42994.exe
        7⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3916.exe
        8⤵
        
        PID:9292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14899.exe
        8⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44092.exe
        7⤵
        
        PID:9240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65155.exe
        7⤵
        
        PID:13320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36084.exe
        7⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21015.exe
        6⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44949.exe
        7⤵
        
        PID:10376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47899.exe
        7⤵
        
        PID:1552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34860.exe
        6⤵
        
        PID:10412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46979.exe
        6⤵
        
        PID:13816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10999.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18695.exe
        6⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43309.exe
        7⤵
        
        PID:11684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32203.exe
        7⤵
        
        PID:2956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2763.exe
        6⤵
        
        PID:9420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61668.exe
        6⤵
        
        PID:14056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7243.exe
        6⤵
        
        PID:14436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12456.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11296.exe
        5⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40202.exe
        6⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4076.exe
        7⤵
        
        PID:9148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6338.exe
        7⤵
        
        PID:12492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53267.exe
        7⤵
        
        PID:6448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48892.exe
        6⤵
        
        PID:9480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62197.exe
        7⤵
        
        PID:1556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47651.exe
        6⤵
        
        PID:12768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45675.exe
        6⤵
        
        PID:15840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41080.exe
        5⤵
        
        PID:7344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13588.exe
        6⤵
        
        PID:8916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47180.exe
        6⤵
        
        PID:11968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12690.exe
        6⤵
        
        PID:15532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19939.exe
        5⤵
        
        PID:9360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45573.exe
        5⤵
        
        PID:11548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35675.exe
        5⤵
        
        PID:15496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60865.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-305.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58857.exe
        6⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10025.exe
        7⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57917.exe
        8⤵
        
        PID:13080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9275.exe
        8⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59364.exe
        7⤵
        
        PID:9572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17090.exe
        7⤵
        
        PID:12940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9095.exe
        6⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49437.exe
        7⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52660.exe
        7⤵
        
        PID:14080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37044.exe
        7⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19191.exe
        7⤵
        
        PID:9300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4866.exe
        6⤵
        
        PID:10184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5835.exe
        6⤵
        
        PID:13940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3444.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39256.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20114.exe
        6⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50306.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-828.exe
        8⤵
        
        PID:11128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12795.exe
        8⤵
        
        PID:14956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63308.exe
        7⤵
        
        PID:10308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7594.exe
        7⤵
        
        PID:13288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10544.exe
        6⤵
        
        PID:7880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31210.exe
        6⤵
        
        PID:9908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15675.exe
        6⤵
        
        PID:15212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18207.exe
        5⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29450.exe
        6⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13812.exe
        7⤵
        
        PID:13596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39347.exe
        7⤵
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29298.exe
        6⤵
        
        PID:10736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29276.exe
        5⤵
        
        PID:8760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41779.exe
        5⤵
        
        PID:11940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42555.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43184.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33082.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18386.exe
        6⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32802.exe
        7⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63274.exe
        8⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4794.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51092.exe
        7⤵
        
        PID:8888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60828.exe
        7⤵
        
        PID:12272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28371.exe
        7⤵
        
        PID:688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44753.exe
        6⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44741.exe
        7⤵
        
        PID:8008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4371.exe
        7⤵
        
        PID:6844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58299.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11051.exe
        6⤵
        
        PID:12948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13738.exe
        6⤵
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62196.exe
        6⤵
        
        PID:2936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31576.exe
        5⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35314.exe
        6⤵
        
        PID:7316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64460.exe
        6⤵
        
        PID:10484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49779.exe
        6⤵
        
        PID:13744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-935.exe
        6⤵
        
        PID:8832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64736.exe
        5⤵
        
        PID:7712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56085.exe
        6⤵
        
        PID:13236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34163.exe
        6⤵
        
        PID:6364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61580.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25074.exe
        5⤵
        
        PID:15352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43481.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18770.exe
        5⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5905.exe
        6⤵
        
        PID:8024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15244.exe
        7⤵
        
        PID:13156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17500.exe
        7⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38244.exe
        6⤵
        
        PID:13756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27890.exe
        6⤵
        
        PID:9788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42256.exe
        5⤵
        
        PID:6736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31210.exe
        5⤵
        
        PID:8708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49308.exe
        5⤵
        
        PID:14424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52792.exe
      4⤵
      PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24634.exe
        5⤵
        
        PID:6492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63274.exe
        6⤵
        
        PID:8064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53428.exe
        7⤵
        
        PID:13768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56643.exe
        7⤵
        
        PID:14916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41979.exe
        6⤵
        
        PID:10320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27874.exe
        6⤵
        
        PID:15304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37044.exe
        6⤵
        
        PID:6416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10059.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52747.exe
        5⤵
        
        PID:11904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18363.exe
        5⤵
        
        PID:15464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45475.exe
        5⤵
        
        PID:15480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14648.exe
      4⤵
      PID:6556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36173.exe
        5⤵
        
        PID:8224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46293.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14842.exe
        6⤵
        
        PID:1732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63132.exe
        5⤵
        
        PID:11652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45675.exe
        5⤵
        
        PID:6820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52765.exe
      4⤵
      PID:9252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13762.exe
      4⤵
      PID:10864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63612.exe
      4⤵
      PID:2540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13863.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13863.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15001.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24042.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42786.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20114.exe
        7⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61930.exe
        8⤵
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33707.exe
        8⤵
        
        PID:14704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4461.exe
        8⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39555.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27860.exe
        7⤵
        
        PID:12248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12194.exe
        7⤵
        
        PID:15792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36117.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41576.exe
        6⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46170.exe
        7⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63132.exe
        7⤵
        
        PID:11804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55643.exe
        7⤵
        
        PID:15660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22450.exe
        6⤵
        
        PID:9004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3538.exe
        6⤵
        
        PID:12476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52894.exe
        6⤵
        
        PID:964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57897.exe
        5⤵
        
        PID:4524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45490.exe
        6⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10617.exe
        7⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21314.exe
        7⤵
        
        PID:11036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31628.exe
        7⤵
        
        PID:15132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10352.exe
        6⤵
        
        PID:7760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6037.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31210.exe
        6⤵
        
        PID:10232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15675.exe
        6⤵
        
        PID:15220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62644.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2743.exe
        5⤵
        
        PID:7140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60901.exe
        6⤵
        
        PID:13436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50229.exe
        6⤵
        
        PID:7240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54844.exe
        5⤵
        
        PID:9708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14290.exe
        5⤵
        
        PID:13024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13916.exe
        5⤵
        
        PID:3392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63536.exe
        5⤵
        
        PID:9312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53569.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        5⤵
        
        PID:3944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14545.exe
        6⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44341.exe
        7⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63132.exe
        7⤵
        
        PID:11672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62011.exe
        7⤵
        
        PID:2704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11211.exe
        6⤵
        
        PID:8384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12203.exe
        6⤵
        
        PID:11864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13187.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28119.exe
        5⤵
        
        PID:8016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24093.exe
        6⤵
        
        PID:13792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58476.exe
        6⤵
        
        PID:4116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31404.exe
        5⤵
        
        PID:7852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4986.exe
        5⤵
        
        PID:14124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44707.exe
        5⤵
        
        PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52586.exe
        5⤵
        
        PID:9288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63848.exe
      4⤵
      PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4457.exe
        5⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49437.exe
        6⤵
        
        PID:1492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50355.exe
        6⤵
        
        PID:8520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11211.exe
        5⤵
        
        PID:8292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12203.exe
        5⤵
        
        PID:12212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5218.exe
        5⤵
        
        PID:4996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23129.exe
      4⤵
      PID:6476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62789.exe
        5⤵
        
        PID:8844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30843.exe
        5⤵
        
        PID:11952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6058.exe
        5⤵
        
        PID:15812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52235.exe
      4⤵
      PID:9232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18227.exe
      4⤵
      PID:460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7378.exe
      4⤵
      PID:1428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14928.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14928.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7705.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19050.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61722.exe
        6⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27146.exe
        7⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exe
        8⤵
        
        PID:14988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22672.exe
        8⤵
        
        PID:8836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29779.exe
        7⤵
        
        PID:10900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45067.exe
        7⤵
        
        PID:14816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56094.exe
        7⤵
        
        PID:14612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38792.exe
        7⤵
        
        PID:9844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42448.exe
        6⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7196.exe
        7⤵
        
        PID:2392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55715.exe
        6⤵
        
        PID:10540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33740.exe
        6⤵
        
        PID:15328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57809.exe
        5⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27146.exe
        6⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5596.exe
        7⤵
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46116.exe
        6⤵
        
        PID:10888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45067.exe
        6⤵
        
        PID:14808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44252.exe
        6⤵
        
        PID:12440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56184.exe
        5⤵
        
        PID:6076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37076.exe
        5⤵
        
        PID:7848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7010.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14752.exe
      4⤵
      PID:2304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61826.exe
        5⤵
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61253.exe
        6⤵
        
        PID:8428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63132.exe
        6⤵
        
        PID:11736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21818.exe
        6⤵
        
        PID:15180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53267.exe
        6⤵
        
        PID:1364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34947.exe
        5⤵
        
        PID:8660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22186.exe
        5⤵
        
        PID:8628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61812.exe
        5⤵
        
        PID:15668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27737.exe
      4⤵
      PID:8108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44741.exe
        5⤵
        
        PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29707.exe
        5⤵
        
        PID:14436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63387.exe
      4⤵
      PID:9768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53796.exe
      4⤵
      PID:13932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15303.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15303.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53258.exe
      4⤵
      PID:3076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28578.exe
        5⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44341.exe
        6⤵
        
        PID:7724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63132.exe
        6⤵
        
        PID:11596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20474.exe
        6⤵
        
        PID:15420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53843.exe
        6⤵
        
        PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11211.exe
        5⤵
        
        PID:8492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12203.exe
        5⤵
        
        PID:13360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33562.exe
        5⤵
        
        PID:8488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13320.exe
      4⤵
      PID:7032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47221.exe
        5⤵
        
        PID:8856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23827.exe
        5⤵
        
        PID:11276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21475.exe
        5⤵
        
        PID:5756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7562.exe
      4⤵
      PID:9612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22956.exe
      4⤵
      PID:12916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10883.exe
      4⤵
      PID:16236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36344.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36344.exe
    3⤵
    PID:2860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4265.exe
      4⤵
      PID:2204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46170.exe
        5⤵
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62157.exe
        6⤵
        
        PID:15876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50884.exe
        6⤵
        
        PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6723.exe
        5⤵
        
        PID:11432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        5⤵
        
        PID:15092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3043.exe
      4⤵
      PID:8396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12203.exe
      4⤵
      PID:11320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44019.exe
      4⤵
      PID:4692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11132.exe
      4⤵
      PID:14672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-473.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-473.exe
    3⤵
    PID:7128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10636.exe
      4⤵
      PID:11760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8083.exe
      4⤵
      PID:15288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17778.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17778.exe
    3⤵
    PID:8408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43123.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43123.exe
    3⤵
    PID:13892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35876.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35876.exe
    3⤵
    PID:16004
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63249.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63249.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1692
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 720
    3⤵
    - Program crash
    PID:2076
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55080.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55080.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19994.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19994.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23362.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62033.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42048.exe
        6⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63485.exe
        7⤵
        
        PID:11988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64811.exe
        7⤵
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27652.exe
        6⤵
        
        PID:9464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36106.exe
        6⤵
        
        PID:12748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62541.exe
        6⤵
        
        PID:2984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32241.exe
        5⤵
        
        PID:5884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53954.exe
        6⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11316.exe
        7⤵
        
        PID:12956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55740.exe
        7⤵
        
        PID:7440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48227.exe
        6⤵
        
        PID:11700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11082.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20610.exe
        5⤵
        
        PID:8736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57724.exe
        5⤵
        
        PID:11748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11380.exe
        5⤵
        
        PID:15204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53569.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53258.exe
        5⤵
        
        PID:1400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22226.exe
        6⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53954.exe
        7⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38597.exe
        8⤵
        
        PID:13248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
        8⤵
        
        PID:7456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62748.exe
        7⤵
        
        PID:13828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36539.exe
        7⤵
        
        PID:1660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63780.exe
        6⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7852 -s 216
        7⤵
        Program crash
        
        PID:8640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51195.exe
        6⤵
        
        PID:10324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22780.exe
        6⤵
        
        PID:12884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36411.exe
        6⤵
        
        PID:7216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41576.exe
        5⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4945.exe
        6⤵
        
        PID:7148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64563.exe
        6⤵
        
        PID:12304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61243.exe
        6⤵
        
        PID:15608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22450.exe
        5⤵
        
        PID:9012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27860.exe
        5⤵
        
        PID:12240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62541.exe
        5⤵
        
        PID:7208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55680.exe
      4⤵
      PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4457.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29450.exe
        6⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64563.exe
        6⤵
        
        PID:12312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29036.exe
        6⤵
        
        PID:16288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37314.exe
        6⤵
        
        PID:1892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17267.exe
        5⤵
        
        PID:9064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20262.exe
        6⤵
        
        PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12203.exe
        5⤵
        
        PID:12228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14960.exe
      4⤵
      PID:6720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45301.exe
        5⤵
        
        PID:9036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49100.exe
        5⤵
        
        PID:12216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37314.exe
        5⤵
        
        PID:912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13122.exe
      4⤵
      PID:9672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7332.exe
      4⤵
      PID:13280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47138.exe
      4⤵
      PID:15812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60865.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60865.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41722.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9184.exe
        5⤵
        
        PID:1380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34250.exe
        6⤵
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49381.exe
        7⤵
        
        PID:15084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25668.exe
        7⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52452.exe
        6⤵
        
        PID:9328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65155.exe
        6⤵
        
        PID:12992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20764.exe
        6⤵
        
        PID:15656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45520.exe
        5⤵
        
        PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18514.exe
        5⤵
        
        PID:11028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23339.exe
        5⤵
        
        PID:14932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62925.exe
        5⤵
        
        PID:15828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40600.exe
      4⤵
      PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30114.exe
        5⤵
        
        PID:6228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36749.exe
        6⤵
        
        PID:8412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63132.exe
        6⤵
        
        PID:11660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27418.exe
        6⤵
        
        PID:5168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49468.exe
        5⤵
        
        PID:4256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52084.exe
        5⤵
        
        PID:13232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2964.exe
        5⤵
        
        PID:6436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17801.exe
        5⤵
        
        PID:8368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9095.exe
      4⤵
      PID:6520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12276.exe
        5⤵
        
        PID:10220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64043.exe
        5⤵
        
        PID:16068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4866.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5835.exe
      4⤵
      PID:13444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37077.exe
      4⤵
      PID:15076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17911.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17911.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10305.exe
      4⤵
      PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61826.exe
        5⤵
        
        PID:3028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46170.exe
        6⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56116.exe
        6⤵
        
        PID:11456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29410.exe
        6⤵
        
        PID:14828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11211.exe
        5⤵
        
        PID:8376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21994.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3675.exe
        5⤵
        
        PID:16184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20248.exe
      4⤵
      PID:6528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43309.exe
        5⤵
        
        PID:11572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37395.exe
        5⤵
        
        PID:15988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54340.exe
        5⤵
        
        PID:8036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15346.exe
      4⤵
      PID:10028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3651.exe
      4⤵
      PID:12148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60355.exe
      4⤵
      PID:15540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19936.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19936.exe
    3⤵
    PID:4088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63258.exe
      4⤵
      PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45786.exe
        5⤵
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60901.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47899.exe
        6⤵
        
        PID:3624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2968.exe
        6⤵
        
        PID:9544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33707.exe
        5⤵
        
        PID:14692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37845.exe
        5⤵
        
        PID:1344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63780.exe
      4⤵
      PID:7836
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7836 -s 212
        5⤵
        Program crash
        
        PID:8704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20826.exe
      4⤵
      PID:10436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55644.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12719.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12719.exe
    3⤵
    PID:5784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53954.exe
      4⤵
      PID:3320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64563.exe
      4⤵
      PID:12296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19259.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19259.exe
    3⤵
    PID:8332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9060.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9060.exe
    3⤵
    PID:11588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22138.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22138.exe
    3⤵
    PID:15268
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36065.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36065.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11161.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18695.exe
        5⤵
        
        PID:6608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-828.exe
        6⤵
        
        PID:10948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28939.exe
        6⤵
        
        PID:14900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16243.exe
        6⤵
        
        PID:2036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2763.exe
        5⤵
        
        PID:9428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36395.exe
        5⤵
        
        PID:13944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24923.exe
        5⤵
        
        PID:7212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31384.exe
      4⤵
      PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22330.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44341.exe
        6⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46293.exe
        7⤵
        
        PID:13584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32507.exe
        7⤵
        
        PID:16096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63132.exe
        6⤵
        
        PID:11624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43947.exe
        6⤵
        
        PID:3428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41299.exe
        5⤵
        
        PID:9268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37563.exe
        5⤵
        
        PID:10728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62011.exe
        5⤵
        
        PID:6180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11103.exe
      4⤵
      PID:1148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53500.exe
      4⤵
      PID:9792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47635.exe
      4⤵
      PID:13300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23003.exe
      4⤵
      PID:6420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62592.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62592.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13953.exe
      4⤵
      PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39818.exe
        5⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19069.exe
        6⤵
        
        PID:8568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63132.exe
        6⤵
        
        PID:11824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20474.exe
        6⤵
        
        PID:15412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59452.exe
        5⤵
        
        PID:8768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22186.exe
        5⤵
        
        PID:11252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37499.exe
        5⤵
        
        PID:5640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12272.exe
      4⤵
      PID:6840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30621.exe
        5⤵
        
        PID:13268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8018.exe
        5⤵
        
        PID:5216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25818.exe
      4⤵
      PID:10140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15364.exe
        5⤵
        
        PID:15100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1164.exe
        5⤵
        
        PID:15700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52084.exe
      4⤵
      PID:13096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12092.exe
      4⤵
      PID:15192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20704.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20704.exe
    3⤵
    PID:5652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17810.exe
      4⤵
      PID:6884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62005.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
      4⤵
      PID:9528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17090.exe
      4⤵
      PID:13008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54916.exe
      4⤵
      PID:5252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16864.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16864.exe
    3⤵
    PID:6936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17596.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17596.exe
    3⤵
    PID:10292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1282.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1282.exe
    3⤵
    PID:14036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43132.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43132.exe
    3⤵
    PID:7820
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6263.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6263.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15874.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15874.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
      4⤵
      PID:4856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5609.exe
        5⤵
        
        PID:6212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13588.exe
        6⤵
        
        PID:8924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39011.exe
        6⤵
        
        PID:11996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45980.exe
        6⤵
        
        PID:15476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2659.exe
        5⤵
        
        PID:8480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52084.exe
        5⤵
        
        PID:13192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10770.exe
        5⤵
        
        PID:2920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30615.exe
      4⤵
      PID:8184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42053.exe
        5⤵
        
        PID:11052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28939.exe
        5⤵
        
        PID:15060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56067.exe
        5⤵
        
        PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25553.exe
        5⤵
        
        PID:8744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6515.exe
      4⤵
      PID:10236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62355.exe
      4⤵
      PID:13116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50113.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50113.exe
    3⤵
    PID:5148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47794.exe
      4⤵
      PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37618.exe
        5⤵
        
        PID:6392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62748.exe
        5⤵
        
        PID:13796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2964.exe
        5⤵
        
        PID:15852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25435.exe
      4⤵
      PID:9048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12203.exe
      4⤵
      PID:13472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27247.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27247.exe
    3⤵
    PID:5264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37189.exe
      4⤵
      PID:15852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54835.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54835.exe
    3⤵
    PID:9700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13427.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13427.exe
    3⤵
    PID:13580
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14912.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14912.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12417.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12417.exe
    3⤵
    PID:4880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4265.exe
      4⤵
      PID:6128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39629.exe
        5⤵
        
        PID:8532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6338.exe
        5⤵
        
        PID:11888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43940.exe
        5⤵
        
        PID:16056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11211.exe
      4⤵
      PID:8276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12203.exe
      4⤵
      PID:11724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53644.exe
      4⤵
      PID:10016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38208.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38208.exe
    3⤵
    PID:7084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7562.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7562.exe
    3⤵
    PID:9620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22956.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22956.exe
    3⤵
    PID:12932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12042.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12042.exe
    3⤵
    PID:15928
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61578.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61578.exe
  2⤵
  PID:5160
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47935.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47935.exe
  2⤵
  PID:5660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35314.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35314.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53702.exe
      4⤵
      PID:5288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29779.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29779.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:10844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12202.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12202.exe
    3⤵
    PID:14648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46556.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46556.exe
    3⤵
    PID:1824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35335.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35335.exe
    3⤵
    PID:8588
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15707.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15707.exe
  2⤵
  PID:2664
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46539.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46539.exe
  2⤵
  PID:11296
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7875.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7875.exe
  2⤵
  PID:14712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1692 -ip 1692
1⤵
PID:4916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 7852 -ip 7852
1⤵
PID:8316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 7844 -ip 7844
1⤵
PID:8368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 7836 -ip 7836
1⤵
PID:8500

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe

Filesize
468KB

MD5
1d83168a111dc761c4afa1a68e5de967

SHA1
6515b0c8efbd2bdf30832bcc41fefef4b994b6a6

SHA256
7d584a3538ae42cf04c229bcfa52a9a05a6458e864f707b3023e1389e168563a

SHA512
d178db18fcfccf8f4922a7b938feee574dfdca5849d656913d3c0c979b761464504456417bb97737c9ff5af796952bb99ca11328fbd40292cb390384f46f9604

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12202.exe

Filesize
468KB

MD5
3f52b098c09020b060bb2622a552835b

SHA1
5c9c2692cdbcf67f11a5f7ec9dc3b525e8d02e26

SHA256
80f13a57aa08aabfad23da4842d62b52a883747f795971eb2f586d1bbbd3e99d

SHA512
100bd4040fa314e03780e083bca867230daebbd271f5f4b0fd7c380c223830dc0ed7d4f724f0fbc556990368c71fccbe772840b26043fb392d585479ed167a52

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13863.exe

Filesize
468KB

MD5
9f396411cf4b34178f7fb1570d4d208a

SHA1
27a3becad2f72940df3ab316cfb2feb4b654e5f1

SHA256
d05d22d7f41ff3d446893ad4c04e6a4ec89dafa838c5a23a70f42020ce7914e8

SHA512
79792bb10d2bfca5e7b46c6f958794107ece6734d5e4f8a3e9d9c0937c85cc6cd7435e57d3569a241528fab67334537d9edeb4b9dee41ca38057091588ab68b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14617.exe

Filesize
468KB

MD5
01b4f9ed1269a7625a425aa192e76ee3

SHA1
81a48c4ba83c3d0005f2523de58a995533c43b67

SHA256
c13cb70c94321a3ab4a04359d2805555085f17b231b6bc9e5cbaae5c29562552

SHA512
d1f2b19ca9c6e475057d6cb6ea0e5d677a7580ec2a03b2bbce6eb421bc1db801d16229a1d28d37c82d462093c91b0bc7fb9e2cb0a3d325044bdf1cbcf2c22b4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14928.exe

Filesize
468KB

MD5
5ac0a5685e781a51427916cefcd948d3

SHA1
6583fa514d874546533f4954e8a7e37d14140306

SHA256
31f23ac2e4f99c3d7b238b429293fba021e8ef044b5a5b9d6e4a0e3cc3902d0f

SHA512
8e639e1049d9b3bde77f81c1f01e3c6e4f4ef5c49048d8deb92ffd986dc7db95e3923343c8c7a4e9fb7e28d88838c989c81e0804d9a646cd91d9c89bc243452c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15001.exe

Filesize
468KB

MD5
efbd2e21d4dc4a1362effc3807af84c7

SHA1
882faf49f9afa28567472c4fcbeddcb2ae5c5024

SHA256
287d02ef709ddcc441d214a311017ffc9d5e556faf260590f2a57452fed663d3

SHA512
f8f5ceb254f4be51e18b9440a9b05b5c0791c57462b085f12b51e454e5838de351f45a7d4237d14d4a957350eb1bcc0353c1e8e79fa51a94d20d731d6d4d2039

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe

Filesize
468KB

MD5
81801cfebb544eb4e0d74af95aa4a51e

SHA1
c2cec07d2869b97828f088480692ad4bad8b779b

SHA256
35df7e2845abc6cb08b4ac4198fdac51dc3befd42f020a2e68a871638e1d658f

SHA512
742ba2512edd7d5dde96fade63f847d8ef8fb512bf3ce215cdaaed44255eb89391b075c1569c0554264ed3ae3208d08b5356ff00277c6fa5f90506bfdd065172

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19994.exe

Filesize
468KB

MD5
8288239459bbc6bf290dca9553da7ed1

SHA1
c4de7ed6956d0778834856545b3cfc9aa59ea36e

SHA256
b79cb347c92681361d60710a71015eddca4967e01a4b1b89cc86f3d629aa1531

SHA512
79e670cd203a64c9aaa6d13f57d9eded3d4f7e1d191a695112cf6365d54e6fbceb87797e5f7400e25d514dfa06523782cdadce6565d7365f955a16302f9a26b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21146.exe

Filesize
468KB

MD5
c31c816b0e3f70ab67a24d7f2d8aebf8

SHA1
8911ef9846b2740d5c7f5eb71077dd0837224f1c

SHA256
e4b58451ca1fd4f5aa54f86f6b8e3f93ed116956cedc9cd8805164f50d73c07b

SHA512
f7144e2993aaa5c45011b39a37dc948cf914bbb092e5da5f9c6215d76f8b13903b26b3066d5a0698b337d377f0cac85bb91fbe3ef9b1c3836319c814a48146fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22506.exe

Filesize
468KB

MD5
b497b443820d906c0c14e12a6fd23e44

SHA1
5d688e132607a0bce55cf43380d8919f0b180d8b

SHA256
31a68123ee7cafa8fc7b1d9b1d019d796b7e824a7ed858a17df8ad0b5e63ba64

SHA512
2b5682311bbf74c7e03f44e580330890630db0724ce27ed561b73b189f3c41239c035a917746ca56a48a9e38f86d9623c60ae62592243a6c769468f79c933371

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23362.exe

Filesize
468KB

MD5
e6283c765db788409f8ad3714467fb1b

SHA1
b185aa2aeffb32c9c35835ff99d4b8aa51996eb8

SHA256
11ebb3c7bd91cc70e1c9996d3f486187d54d4c4f9047b8d526487b516cbed113

SHA512
2d0fd099525c907ef9246d84608b6b965a17263a3f6102fab281a7f11836a8571191e8f3708973f90dfe22a8e0c42061363153913aa6950f645b67536add8bd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25746.exe

Filesize
468KB

MD5
b8466c64abfa6b3ff985bc0ba08b2245

SHA1
f2a28cfe56462a80c5dd2c4dedcff6e4048cb008

SHA256
97d3646cf10791bf9cafbfa05d7d732e959bb25a4975ce304fbafc380120483c

SHA512
01d3673599876a626c1a1e5bcf2bc9bf6f5cf589cfafd06bc985147242699dd31a07257f8edef7d368c2e80fb7ff6e6b3f66162cd6b4c3ba7f23846337e0b915

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27528.exe

Filesize
468KB

MD5
e7a9269423811fc5a0d87ff0454e54af

SHA1
2c00feee838764e66fc1b52707b1277d5975ba2d

SHA256
99083856837d9ac522ecb9d7a460e2232e2b6c1f0e0bf62dd9579e536bcae62b

SHA512
f7704cb6c664e7d029bae9cb04748ae71ac0916c865072d2c2ef3ca07130e99431e0931cbccaab41440cc1d6e5a4140cc2c553751ac6742b0c7de0974c308bb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2919.exe

Filesize
468KB

MD5
ed02e90361bffaee4612da3aa8bb0207

SHA1
c4915c45de79d012be029e1c86efac61e0150a3e

SHA256
42117960b804a92b8873933c27996409f0932235ef75d47ed48e6c1c2b5cb360

SHA512
027f0a2614e121732ce0c7d92238f9950e351703c2a41a9f782a2619f7df513559d40975aa8624a4bd6d2ae4a1a78f2de2e0ec6dc70702773eebbca00d2236e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-305.exe

Filesize
468KB

MD5
b334129d43b5772c263d5e64965f6ad4

SHA1
ddab998be16ff427e6f090949f1d2a84b7b588c3

SHA256
3a049b7f30f8e500911ed316ea9f5d151a6daa46e13a5469051390eb16d7d501

SHA512
38f7ec25ffca08005339b757d6fdb46bc384ea59dbb211cf60df5ad36a1dc36e6029bbc493075228e2e6451b562a4f0676b176816fc9a2d44c56aeab8a7c5810

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33864.exe

Filesize
468KB

MD5
e96df18deacfa1ccc016ef43259f9173

SHA1
f15f80602ab0bb6490966f7b3351810ff3b40805

SHA256
a96e66ed8ff6a293c61f599b267940542ce7496e5ca9c73da43c634f695bda30

SHA512
59ff54008f62fa5876646e2416d206273ab7ea5cd57d7a85ebf99855f4d85b5cd3244f3049152b5e35dea1c2a50b203e0ea87dbd01e7465a1e7a8348842d519e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33952.exe

Filesize
468KB

MD5
bfd668c1f049825e851bfdf280dc145b

SHA1
098616845708ded60d2c2bd52df617cebacdcf7c

SHA256
a472fc5e97c19f12c737b00559fbb53b69e4d0f87bf1c514572ebd849df1d124

SHA512
0f26570d39f04ff2efda5395e8d31d3658912d0def58af330fd5d7754edb22d3563fdf7c7faed92e026bac8cd92093bb5ec9c1b01bb0dee38db61459ffc01f2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36065.exe

Filesize
468KB

MD5
b300c3f6d1d63b8fd4a8ab5468efdba4

SHA1
56c3e3308ad193ca8a9fad2f64d4a38ad4bd0976

SHA256
63707982aa9e0209b8ae2202be92a0fe7c66cfd54e38bde2d4ad79113c517184

SHA512
d4e53d3cd4b7a706675e513fd1bcc301861fa6fc3ee2005bb6b6e668893edf8cd8285dc4e0cbaac41132860301b2bc8a3223ad3f7ca48128be2ff18752c350c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39011.exe

Filesize
468KB

MD5
5e4bff0a9511c755983c504412f86132

SHA1
c2667b1cd9a39b40f0ef8361c9bd1bf985c39c4c

SHA256
f0504f47398e5289b15c55f6b9bbcbbdcb9d8a1f49b27de147849a8709fe9215

SHA512
a9c992bc0d9217bff061834442a1a19e38a9cc3abbf05d3aa095d09bc8bafa1ec534d36efff57cb7e33a74de0e4b94b668373f372fa97fdd2a763b06dac7d49f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41344.exe

Filesize
468KB

MD5
e730168c6e972f208a80b079da8b937e

SHA1
783b2071d2a9996687aaefe49c4d4303e9b6f8cd

SHA256
644ee903b41db295edd44eb2c8611c28f7ec9e5f811ee64ef5e904b0add34d8c

SHA512
d17462099b80553369e7d83323ae078ca92cb8a61765cd46e3b84a593244811fbb19af037e15b559a7b42c7b209a296040f1c41892faa881bdbc402a1616d52c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43184.exe

Filesize
468KB

MD5
0e30ea05145e940187fdaf10ee7c04b8

SHA1
6ff5cf5d7278cb2290d15ed0178200d28238cda0

SHA256
148557d6dae0d11dd433c2c36edf5ea17d464f9e77e26600babbf12f89178519

SHA512
da8bd4745c4c3d676c82034544bacad194a951bcefc32376a16049cd0af6fde0d30336c06f581b0e37c71c8ca6ba2ec312fdce49130aa5f632e8ba6014302a3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44874.exe

Filesize
468KB

MD5
8666ba666a0810923945c67c001caf26

SHA1
42057ec0bfb660b365e295c4f14490076b729959

SHA256
4bc2fda09d2879c2aa4f1d98d829273174332ce7976f005e0b753ac484711931

SHA512
ac052657a2ffe6100e157a4aa348f2e0420445f293fb91123f92ed45e6f596f8d9a262605760447cdbd26ba1d3152a9716f363919cb7d7817635125e80391001

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4721.exe

Filesize
468KB

MD5
df314c0142e020a6c6072b8bf7434045

SHA1
3b8e6565427fdeb76af025f6c0668f229b639dff

SHA256
d2eea6208bdaef8bea4b4f36d96c889d0423079aad954593703a5fd1ebedb5af

SHA512
3a7c1ff558ec8727b7db73922ec1b6c24316bf36472fa86f4edbda56ef875c4cf3957fbe4558eb6c967116ddcd9687e7a7649c71bc3ed46d8a455c7452b6e02f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52801.exe

Filesize
468KB

MD5
2549dc6063ff5d579137d804b51e5995

SHA1
1f2332eaafddae50d25931b73449bb50ac9a1876

SHA256
2f87fcac8930c218a65c281ff38a655f26ef36c3e42ce90e95ede97c74df43c3

SHA512
e27f47617b6935180d388b5d2a8b8a3abf6a1cc27a9d3d2c91ce2d5af5a60a952b01868e2d41dba7f4e51ad53a6c3afa7f5d3f75ce4195362ec67634653f4853

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55080.exe

Filesize
468KB

MD5
e3c742e529c8f2d7fa8d0f173d16ebd6

SHA1
26aa87147db4820abd6b0a3a0ceb5eb60698d28e

SHA256
8f7d37184b7bfc9cced667487a513e7122086ef9f19019201f0bd056e58ec998

SHA512
63ff4a96130a212ef6c4f044ba0cb439b75a405a33a80fbd9c9f20b54f879dc1f64e31411904a1ce3fa54558fc2135bf3d89d89c65a47b757838c924315e7577

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-561.exe

Filesize
468KB

MD5
665d22068d2c3e1764f564343ea12a86

SHA1
8ca51acdd44cb7da9efd85ffd73a64971423e45e

SHA256
e8593fc2b75feb7fec4902c11f0ad9572217937c11a7368d2782bcfb11205e6c

SHA512
d712fc02a67d77e51fb00983a884f5d1b4d1acb5551d9955f43c491edf7a2cad1cb23d30aee9a9618a8a3864a31bd464ef9f5290238ccf21c9a50273dbbeee20

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60865.exe

Filesize
468KB

MD5
27fbfeb7da711bb03400b894432b0a94

SHA1
b6c411f1ec445660b13377da3523d91dc70005c5

SHA256
46fe000663b10a7e8b6ad6e6000a1ae9d077cf70c82a9966a34131328b14cd6f

SHA512
9c30a62ee83fde5874fb1471d92300498775d83ed9081d1f1e046262fb56dc83d9c19fb6ceee248ec29363ca5cc33cdef86919fa715792aefa5ba47a674879a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6263.exe

Filesize
468KB

MD5
2784258777a9d0ceb6497a5610225c5f

SHA1
f9bc41bc0a3c6c6834d79889974438641d52f942

SHA256
0885716004b15028afa828f87c0a0dcec4d6a8da39c147a239fb9bc8a03e0bec

SHA512
848559a9952f4b93cc58619c7d58a3a3226fab35673b2d192b46d8b366be5856b01ff8564289e18d238ee2fda95ac3e772e8ff0410ab2860d2a70bab709e7fba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63249.exe

Filesize
468KB

MD5
5ef42add36edc869dfb9bbe8a426586a

SHA1
9cccb45de254b6fe31716308387e248c9f382086

SHA256
6bc0f284eaf6fd37c331fb6997484c84225031b41bdaf28e581b34825fcb92f4

SHA512
ef312b752a1a1d6b6d8a3f2a6b4f7e2c806b9790ee3b9da431bd785da2a84beb0067c4e354dadb7ed873559dec2cdf6fc3fb83cc035376270482184300d3c612

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6937.exe

Filesize
468KB

MD5
3679cd2b659b7854b0d3de4872be2e7b

SHA1
143dfc31d713cc1787c6463e92021db770b0b50d

SHA256
78a6b3424f7413a5b2dd64965d9ca1e60ed8db1e40345828bb93e1e225cdbe3b

SHA512
cc6dbca51bdc8b0757d7e59221127653c77f14ffb704ce6d4b40f590429a43b45dd5c7ab9ff090a4cb47da9e77754fcf3f6bc7919c2678c24d75df656ae48c3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8473.exe

Filesize
468KB

MD5
8a67ce9cd30284504eb8a38dd9e4a9e1

SHA1
98d373f1ccb4692e02e24f4cfdf5dc1a8349c598

SHA256
b45878694ed2aaab04231e44de46b206d43015630ba60ab94afeef7e13334609

SHA512
7e9f213b03e4799a00aefe61d51b3598558fb47367cca555911e0a059008dcc282c29adcea504cfdbf559163e6f9982e2b73b9603c7b8ba4271b2a1fe6b03bfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8784.exe

Filesize
468KB

MD5
bb2b9aa8228cfc38aa4e4af19164de61

SHA1
3b406a8c4359fd126cd62685e3548e637b2ebce8

SHA256
355f5caec24083ae190a48512d8d27f54f4df720dcbf38f0e425fb585e26335a

SHA512
1a0cd2c2c2be708b213b410cb9aaf2adb8bde7b4d508b14a4f69802febc2d0474c0025c0ad3d63e1007779745281f9257893ad11b29ef49b1927593bfe0a0f42

Download Submit
memory/392-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/524-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/540-280-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/544-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/608-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/620-189-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/660-141-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/924-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/972-447-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1048-89-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1052-252-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1120-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1160-242-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1264-40-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1284-342-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1308-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1400-418-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1432-256-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1560-78-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1692-45-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1692-20-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1820-233-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1912-288-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1960-54-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2080-269-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2088-207-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2100-159-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2176-143-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2208-300-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2224-49-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2304-398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2316-303-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2336-28-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2380-167-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2496-275-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2516-320-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2572-79-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2736-39-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2860-425-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2928-174-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3004-450-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3292-389-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3352-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3388-204-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3408-254-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3436-390-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3452-183-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3480-341-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3512-73-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3532-97-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3548-241-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3560-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3584-364-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3700-353-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3944-422-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4088-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4124-131-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4160-144-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4260-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4300-234-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4312-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4524-421-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4616-142-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4624-354-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4664-196-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4788-244-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4804-400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4812-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4860-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4880-439-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4904-104-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5136-499-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5148-451-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5160-452-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5192-501-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5224-470-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5280-500-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5380-502-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5420-489-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5452-490-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5460-491-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5508-492-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5556-493-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5604-494-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5620-495-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5652-496-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5684-497-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5708-498-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5852-544-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5860-545-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5916-546-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5924-593-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5972-554-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6028-556-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6084-575-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6104-589-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15084-2669-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads