5462fc8a8aca0e0e7ed66d5002eacf26259f7b5272758ad038bd44d620746b9b

Analysis

max time kernel
119s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 16:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1680fcf6e2e1b34a7a9d3a206e9d15e0N.exe
Size

468KB
MD5

1680fcf6e2e1b34a7a9d3a206e9d15e0
SHA1

b8324756f4c7eff95df1ef419f40e4b3b2760f12
SHA256

5462fc8a8aca0e0e7ed66d5002eacf26259f7b5272758ad038bd44d620746b9b
SHA512

ef95e6582bfc8d9bf2ff0fa4cace6f102360330831dc9d17ddd02df0336f28605bc45add493e280b9655b075437e317f9942bcdb52e03ba67d4370c7a58fd613
SSDEEP

3072:z4HHogxxjs8U2bYMPa37qf8/ECqW/IpdymHxw/HaGxI+JMCNV6lK:z4noqhU2jPQ7qfS01DGxvKCNV

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
744	Unicorn-28087.exe
3672	Unicorn-46883.exe
3620	Unicorn-51714.exe
868	Unicorn-1138.exe
3896	Unicorn-5777.exe
2764	Unicorn-25643.exe
1684	Unicorn-11344.exe
4888	Unicorn-56499.exe
2688	Unicorn-11382.exe
4904	Unicorn-42201.exe
3976	Unicorn-48066.exe
3036	Unicorn-28465.exe
3416	Unicorn-59358.exe
4380	Unicorn-44505.exe
936	Unicorn-34875.exe
2992	Unicorn-31345.exe
3556	Unicorn-55487.exe
3304	Unicorn-14454.exe
2404	Unicorn-56042.exe
4428	Unicorn-10370.exe
1696	Unicorn-26899.exe
2812	Unicorn-26634.exe
1228	Unicorn-20768.exe
4372	Unicorn-34304.exe
1212	Unicorn-9860.exe
4532	Unicorn-16951.exe
5004	Unicorn-31432.exe
4744	Unicorn-29395.exe
4456	Unicorn-16877.exe
4252	Unicorn-50547.exe
1108	Unicorn-50547.exe
1096	Unicorn-6177.exe
1828	Unicorn-7660.exe
4212	Unicorn-6390.exe
1500	Unicorn-13988.exe
392	Unicorn-50931.exe
1196	Unicorn-50931.exe
2416	Unicorn-5814.exe
2748	Unicorn-63183.exe
5024	Unicorn-63183.exe
3564	Unicorn-63183.exe
1556	Unicorn-1730.exe
1344	Unicorn-18813.exe
1892	Unicorn-10645.exe
4912	Unicorn-24380.exe
2924	Unicorn-5045.exe
1236	Unicorn-42955.exe
4444	Unicorn-14729.exe
4740	Unicorn-14729.exe
4376	Unicorn-59986.exe
1772	Unicorn-34330.exe
928	Unicorn-47807.exe
4620	Unicorn-35363.exe
2396	Unicorn-10858.exe
1444	Unicorn-48362.exe
3584	Unicorn-7521.exe
4440	Unicorn-14869.exe
2612	Unicorn-6204.exe
3116	Unicorn-10858.exe
2220	Unicorn-52467.exe
368	Unicorn-23879.exe
2432	Unicorn-4013.exe
1576	Unicorn-19795.exe
2972	Unicorn-19795.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
15876	13236	WerFault.exe	673
15968	14188	WerFault.exe	651
15988	14204	WerFault.exe	652
4956	15988	WerFault.exe	770
6732	660	WerFault.exe	668
5528	14552	WerFault.exe	702

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2485.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21500.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63850.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11001.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18121.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57129.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44505.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41751.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35711.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8209.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32136.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7161.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63183.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8453.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39117.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19591.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34875.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25003.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25003.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21944.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25112.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29005.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5136.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24199.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54329.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54528.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6141.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37836.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54329.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4996.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39819.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56309.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14234.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54521.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26607.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25327.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62522.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57753.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14191.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27887.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63183.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9929.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50925.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31908.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33056.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11382.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37091.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52903.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61723.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59346.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5036.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59792.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35911.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18121.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58718.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7208.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11491.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6481.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	3712	dwm.exe
Token: SeChangeNotifyPrivilege	3712	dwm.exe
Token: 33	3712	dwm.exe
Token: SeIncBasePriorityPrivilege	3712	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3392	1680fcf6e2e1b34a7a9d3a206e9d15e0N.exe
744	Unicorn-28087.exe
3672	Unicorn-46883.exe
3620	Unicorn-51714.exe
2764	Unicorn-25643.exe
868	Unicorn-1138.exe
3896	Unicorn-5777.exe
1684	Unicorn-11344.exe
2688	Unicorn-11382.exe
4888	Unicorn-56499.exe
4904	Unicorn-42201.exe
3976	Unicorn-48066.exe
3036	Unicorn-28465.exe
3416	Unicorn-59358.exe
4380	Unicorn-44505.exe
936	Unicorn-34875.exe
2992	Unicorn-31345.exe
2812	Unicorn-26634.exe
1696	Unicorn-26899.exe
4372	Unicorn-34304.exe
3304	Unicorn-14454.exe
4428	Unicorn-10370.exe
2404	Unicorn-56042.exe
3556	Unicorn-55487.exe
1228	Unicorn-20768.exe
1212	Unicorn-9860.exe
4532	Unicorn-16951.exe
5004	Unicorn-31432.exe
4744	Unicorn-29395.exe
4456	Unicorn-16877.exe
4252	Unicorn-50547.exe
1108	Unicorn-50547.exe
1096	Unicorn-6177.exe
1828	Unicorn-7660.exe
4212	Unicorn-6390.exe
1500	Unicorn-13988.exe
392	Unicorn-50931.exe
2416	Unicorn-5814.exe
1196	Unicorn-50931.exe
2748	Unicorn-63183.exe
3564	Unicorn-63183.exe
5024	Unicorn-63183.exe
2924	Unicorn-5045.exe
1556	Unicorn-1730.exe
1344	Unicorn-18813.exe
4912	Unicorn-24380.exe
4376	Unicorn-59986.exe
4740	Unicorn-14729.exe
1772	Unicorn-34330.exe
1892	Unicorn-10645.exe
1236	Unicorn-42955.exe
4444	Unicorn-14729.exe
2396	Unicorn-10858.exe
1444	Unicorn-48362.exe
4440	Unicorn-14869.exe
928	Unicorn-47807.exe
4620	Unicorn-35363.exe
2612	Unicorn-6204.exe
3584	Unicorn-7521.exe
448	Unicorn-24433.exe
3116	Unicorn-10858.exe
2220	Unicorn-52467.exe
3960	Unicorn-54697.exe
368	Unicorn-23879.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3392 wrote to memory of 744	3392	1680fcf6e2e1b34a7a9d3a206e9d15e0N.exe	90
PID 3392 wrote to memory of 744	3392	1680fcf6e2e1b34a7a9d3a206e9d15e0N.exe	90
PID 3392 wrote to memory of 744	3392	1680fcf6e2e1b34a7a9d3a206e9d15e0N.exe	90
PID 744 wrote to memory of 3672	744	Unicorn-28087.exe	93
PID 744 wrote to memory of 3672	744	Unicorn-28087.exe	93
PID 744 wrote to memory of 3672	744	Unicorn-28087.exe	93
PID 3392 wrote to memory of 3620	3392	1680fcf6e2e1b34a7a9d3a206e9d15e0N.exe	94
PID 3392 wrote to memory of 3620	3392	1680fcf6e2e1b34a7a9d3a206e9d15e0N.exe	94
PID 3392 wrote to memory of 3620	3392	1680fcf6e2e1b34a7a9d3a206e9d15e0N.exe	94
PID 3672 wrote to memory of 868	3672	Unicorn-46883.exe	97
PID 3672 wrote to memory of 868	3672	Unicorn-46883.exe	97
PID 3672 wrote to memory of 868	3672	Unicorn-46883.exe	97
PID 744 wrote to memory of 3896	744	Unicorn-28087.exe	98
PID 744 wrote to memory of 3896	744	Unicorn-28087.exe	98
PID 744 wrote to memory of 3896	744	Unicorn-28087.exe	98
PID 3620 wrote to memory of 2764	3620	Unicorn-51714.exe	99
PID 3620 wrote to memory of 2764	3620	Unicorn-51714.exe	99
PID 3620 wrote to memory of 2764	3620	Unicorn-51714.exe	99
PID 3392 wrote to memory of 1684	3392	1680fcf6e2e1b34a7a9d3a206e9d15e0N.exe	100
PID 3392 wrote to memory of 1684	3392	1680fcf6e2e1b34a7a9d3a206e9d15e0N.exe	100
PID 3392 wrote to memory of 1684	3392	1680fcf6e2e1b34a7a9d3a206e9d15e0N.exe	100
PID 868 wrote to memory of 4888	868	Unicorn-1138.exe	101
PID 868 wrote to memory of 4888	868	Unicorn-1138.exe	101
PID 868 wrote to memory of 4888	868	Unicorn-1138.exe	101
PID 1684 wrote to memory of 2688	1684	Unicorn-11344.exe	102
PID 1684 wrote to memory of 2688	1684	Unicorn-11344.exe	102
PID 1684 wrote to memory of 2688	1684	Unicorn-11344.exe	102
PID 744 wrote to memory of 4904	744	Unicorn-28087.exe	103
PID 744 wrote to memory of 4904	744	Unicorn-28087.exe	103
PID 744 wrote to memory of 4904	744	Unicorn-28087.exe	103
PID 3392 wrote to memory of 3976	3392	1680fcf6e2e1b34a7a9d3a206e9d15e0N.exe	104
PID 3392 wrote to memory of 3976	3392	1680fcf6e2e1b34a7a9d3a206e9d15e0N.exe	104
PID 3392 wrote to memory of 3976	3392	1680fcf6e2e1b34a7a9d3a206e9d15e0N.exe	104
PID 3672 wrote to memory of 3036	3672	Unicorn-46883.exe	105
PID 3672 wrote to memory of 3036	3672	Unicorn-46883.exe	105
PID 3672 wrote to memory of 3036	3672	Unicorn-46883.exe	105
PID 3896 wrote to memory of 3416	3896	Unicorn-5777.exe	106
PID 3896 wrote to memory of 3416	3896	Unicorn-5777.exe	106
PID 3896 wrote to memory of 3416	3896	Unicorn-5777.exe	106
PID 3620 wrote to memory of 4380	3620	Unicorn-51714.exe	107
PID 3620 wrote to memory of 4380	3620	Unicorn-51714.exe	107
PID 3620 wrote to memory of 4380	3620	Unicorn-51714.exe	107
PID 4888 wrote to memory of 936	4888	Unicorn-56499.exe	108
PID 4888 wrote to memory of 936	4888	Unicorn-56499.exe	108
PID 4888 wrote to memory of 936	4888	Unicorn-56499.exe	108
PID 868 wrote to memory of 2992	868	Unicorn-1138.exe	109
PID 868 wrote to memory of 2992	868	Unicorn-1138.exe	109
PID 868 wrote to memory of 2992	868	Unicorn-1138.exe	109
PID 2688 wrote to memory of 3556	2688	Unicorn-11382.exe	110
PID 2688 wrote to memory of 3556	2688	Unicorn-11382.exe	110
PID 2688 wrote to memory of 3556	2688	Unicorn-11382.exe	110
PID 3036 wrote to memory of 3304	3036	Unicorn-28465.exe	111
PID 3036 wrote to memory of 3304	3036	Unicorn-28465.exe	111
PID 3036 wrote to memory of 3304	3036	Unicorn-28465.exe	111
PID 1684 wrote to memory of 2404	1684	Unicorn-11344.exe	112
PID 1684 wrote to memory of 2404	1684	Unicorn-11344.exe	112
PID 1684 wrote to memory of 2404	1684	Unicorn-11344.exe	112
PID 4904 wrote to memory of 4428	4904	Unicorn-42201.exe	113
PID 4904 wrote to memory of 4428	4904	Unicorn-42201.exe	113
PID 4904 wrote to memory of 4428	4904	Unicorn-42201.exe	113
PID 3976 wrote to memory of 1696	3976	Unicorn-48066.exe	114
PID 3976 wrote to memory of 1696	3976	Unicorn-48066.exe	114
PID 3976 wrote to memory of 1696	3976	Unicorn-48066.exe	114
PID 744 wrote to memory of 2812	744	Unicorn-28087.exe	115

C:\Users\Admin\AppData\Local\Temp\1680fcf6e2e1b34a7a9d3a206e9d15e0N.exe
"C:\Users\Admin\AppData\Local\Temp\1680fcf6e2e1b34a7a9d3a206e9d15e0N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28087.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28087.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46883.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46883.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1138.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56499.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34875.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50547.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52467.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15430.exe
        9⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19847.exe
        10⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21251.exe
        11⤵
        
        PID:10160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44021.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:13364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63850.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:8520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47601.exe
        10⤵
        
        PID:9388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51894.exe
        10⤵
        
        PID:13392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6141.exe
        9⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61619.exe
        10⤵
        
        PID:11144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39989.exe
        10⤵
        
        PID:14772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26988.exe
        9⤵
        
        PID:8992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7161.exe
        9⤵
        
        PID:12752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26073.exe
        8⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51279.exe
        9⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7758.exe
        10⤵
        
        PID:11164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11488.exe
        10⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29781.exe
        9⤵
        
        PID:9364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4996.exe
        9⤵
        
        PID:13436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57248.exe
        9⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12860.exe
        8⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27759.exe
        9⤵
        
        PID:14592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33778.exe
        8⤵
        
        PID:8420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42749.exe
        8⤵
        
        PID:14816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13124.exe
        8⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4013.exe
        7⤵
        Executes dropped EXE
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24559.exe
        8⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34175.exe
        9⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33695.exe
        10⤵
        
        PID:10216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44021.exe
        10⤵
        
        PID:13356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62341.exe
        10⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8209.exe
        9⤵
        
        PID:9708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57321.exe
        9⤵
        
        PID:12952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48989.exe
        8⤵
        
        PID:8028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16237.exe
        8⤵
        
        PID:11040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50925.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48937.exe
        7⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42299.exe
        8⤵
        
        PID:8716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14281.exe
        8⤵
        
        PID:13264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8751.exe
        8⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24565.exe
        7⤵
        
        PID:8676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27615.exe
        7⤵
        
        PID:13564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39066.exe
        7⤵
        
        PID:7748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6177.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19795.exe
        7⤵
        Executes dropped EXE
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64750.exe
        8⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58635.exe
        9⤵
        
        PID:8808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39117.exe
        9⤵
        
        PID:12308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43569.exe
        8⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28978.exe
        8⤵
        
        PID:12284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37531.exe
        8⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27033.exe
        7⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19575.exe
        8⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51266.exe
        8⤵
        
        PID:11552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59345.exe
        8⤵
        
        PID:9968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17416.exe
        8⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41101.exe
        7⤵
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10549.exe
        7⤵
        
        PID:13300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54697.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57615.exe
        7⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27351.exe
        8⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43519.exe
        9⤵
        
        PID:15080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39707.exe
        9⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39641.exe
        8⤵
        
        PID:10260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40129.exe
        8⤵
        
        PID:14000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53104.exe
        8⤵
        
        PID:11728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54906.exe
        7⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27860.exe
        7⤵
        
        PID:9300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36238.exe
        7⤵
        
        PID:15232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62970.exe
        6⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4582.exe
        7⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18121.exe
        7⤵
        
        PID:10672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38988.exe
        7⤵
        
        PID:15724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40769.exe
        6⤵
        
        PID:6256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12521.exe
        6⤵
        
        PID:12168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31345.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50547.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23879.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42793.exe
        8⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49233.exe
        8⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17515.exe
        9⤵
        
        PID:9952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34561.exe
        9⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39180.exe
        9⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53466.exe
        8⤵
        
        PID:9284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2196.exe
        8⤵
        
        PID:13424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42113.exe
        7⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61951.exe
        8⤵
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18121.exe
        8⤵
        
        PID:11568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39180.exe
        8⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17913.exe
        7⤵
        
        PID:8504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54137.exe
        7⤵
        
        PID:12364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14499.exe
        7⤵
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24433.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39935.exe
        7⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28975.exe
        8⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33695.exe
        9⤵
        
        PID:10188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44021.exe
        9⤵
        
        PID:13388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59308.exe
        9⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53710.exe
        8⤵
        
        PID:9488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7544.exe
        8⤵
        
        PID:12764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64662.exe
        7⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2870.exe
        8⤵
        
        PID:14156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53377.exe
        7⤵
        
        PID:10252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62330.exe
        7⤵
        
        PID:13200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26596.exe
        6⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11590.exe
        7⤵
        
        PID:7528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64529.exe
        8⤵
        
        PID:10620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15521.exe
        7⤵
        
        PID:10924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50217.exe
        7⤵
        
        PID:14464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1185.exe
        6⤵
        
        PID:6620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17084.exe
        6⤵
        
        PID:10104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11037.exe
        6⤵
        
        PID:15152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7660.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19795.exe
        6⤵
        Executes dropped EXE
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15430.exe
        7⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60111.exe
        8⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20911.exe
        9⤵
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27759.exe
        10⤵
        
        PID:14576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62344.exe
        10⤵
        
        PID:9644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36133.exe
        9⤵
        
        PID:11000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61125.exe
        9⤵
        
        PID:14324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58990.exe
        8⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19591.exe
        9⤵
        
        PID:14476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        9⤵
        
        PID:11392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32136.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36238.exe
        8⤵
        
        PID:15180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44115.exe
        8⤵
        
        PID:11208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6141.exe
        7⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4582.exe
        8⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18121.exe
        8⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13414.exe
        8⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21259.exe
        8⤵
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-756.exe
        7⤵
        
        PID:9228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62994.exe
        7⤵
        
        PID:12576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23743.exe
        7⤵
        
        PID:15552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53428.exe
        7⤵
        
        PID:11068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41449.exe
        6⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32483.exe
        7⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16044.exe
        7⤵
        
        PID:10052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61982.exe
        7⤵
        
        PID:14056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37749.exe
        6⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45563.exe
        7⤵
        
        PID:8544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48630.exe
        7⤵
        
        PID:13452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26110.exe
        7⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14234.exe
        6⤵
        
        PID:10172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57017.exe
        6⤵
        
        PID:14228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23879.exe
        6⤵
        
        PID:15992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60562.exe
        5⤵
        
        PID:2344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64750.exe
        6⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17603.exe
        7⤵
        
        PID:9132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39117.exe
        7⤵
        
        PID:10520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30770.exe
        7⤵
        
        PID:6408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27232.exe
        6⤵
        
        PID:8088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37722.exe
        6⤵
        
        PID:10712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36187.exe
        6⤵
        
        PID:2360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57621.exe
        5⤵
        
        PID:6128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35711.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50934.exe
        6⤵
        
        PID:9116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47171.exe
        6⤵
        
        PID:15760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45029.exe
        5⤵
        
        PID:7948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-318.exe
        5⤵
        
        PID:10516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51112.exe
        5⤵
        
        PID:14528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28465.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14454.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63183.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45045.exe
        7⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58635.exe
        8⤵
        
        PID:8776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39117.exe
        8⤵
        
        PID:12292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46502.exe
        7⤵
        
        PID:8408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29056.exe
        7⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47171.exe
        7⤵
        
        PID:15700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41065.exe
        6⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52903.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4582.exe
        8⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18121.exe
        8⤵
        
        PID:10944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38988.exe
        8⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24545.exe
        7⤵
        
        PID:8364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57129.exe
        7⤵
        
        PID:12600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46197.exe
        7⤵
        
        PID:16180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57209.exe
        6⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37987.exe
        7⤵
        
        PID:11616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52964.exe
        7⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14234.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52711.exe
        6⤵
        
        PID:3940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14729.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22291.exe
        6⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43199.exe
        7⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42299.exe
        8⤵
        
        PID:8824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43201.exe
        8⤵
        
        PID:12444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10975.exe
        8⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51301.exe
        7⤵
        
        PID:9608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47426.exe
        7⤵
        
        PID:12908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6141.exe
        6⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31931.exe
        7⤵
        
        PID:13256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62777.exe
        7⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26988.exe
        6⤵
        
        PID:8744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12632.exe
        6⤵
        
        PID:13588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26982.exe
        5⤵
        
        PID:6376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35911.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60010.exe
        6⤵
        
        PID:11468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55261.exe
        6⤵
        
        PID:14748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44612.exe
        6⤵
        
        PID:11748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37836.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12521.exe
        5⤵
        
        PID:12212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20768.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63183.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39011.exe
        6⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47283.exe
        7⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40431.exe
        8⤵
        
        PID:9832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14909.exe
        8⤵
        
        PID:14332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52392.exe
        8⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37596.exe
        8⤵
        
        PID:8664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51301.exe
        7⤵
        
        PID:9624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28428.exe
        7⤵
        
        PID:13344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57753.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6141.exe
        6⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17603.exe
        7⤵
        
        PID:8732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1872.exe
        7⤵
        
        PID:13680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46197.exe
        7⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21944.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22346.exe
        6⤵
        
        PID:13068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3323.exe
        6⤵
        
        PID:608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45918.exe
        5⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22447.exe
        6⤵
        
        PID:7200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34404.exe
        6⤵
        
        PID:12272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21360.exe
        5⤵
        
        PID:7260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15506.exe
        6⤵
        
        PID:14884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-669.exe
        5⤵
        
        PID:11336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19020.exe
        5⤵
        
        PID:14412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15327.exe
        5⤵
        
        PID:11664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34330.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50578.exe
        5⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27351.exe
        6⤵
        
        PID:7180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61427.exe
        7⤵
        
        PID:10964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39989.exe
        7⤵
        
        PID:14848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39641.exe
        6⤵
        
        PID:10272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56465.exe
        6⤵
        
        PID:660
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 660 -s 464
        7⤵
        Program crash
        
        PID:6732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11555.exe
        6⤵
        
        PID:7892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3104.exe
        5⤵
        
        PID:6752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25750.exe
        5⤵
        
        PID:11268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27572.exe
        5⤵
        
        PID:15260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7460.exe
      4⤵
      PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14138.exe
        5⤵
        
        PID:6368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42299.exe
        6⤵
        
        PID:8816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14281.exe
        6⤵
        
        PID:12648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10614.exe
        6⤵
        
        PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16569.exe
        5⤵
        
        PID:9780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24648.exe
        5⤵
        
        PID:13016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56514.exe
      4⤵
      PID:7596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2866.exe
      4⤵
      PID:10752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1153.exe
        5⤵
        
        PID:6928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5036.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5777.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5777.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59358.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16951.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10858.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17992.exe
        7⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25003.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18121.exe
        8⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39180.exe
        8⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52314.exe
        7⤵
        
        PID:8940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54329.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27903.exe
        7⤵
        
        PID:6852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18673.exe
        6⤵
        
        PID:572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1886.exe
        7⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25979.exe
        8⤵
        
        PID:15556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62994.exe
        7⤵
        
        PID:10144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51457.exe
        7⤵
        
        PID:14316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14397.exe
        6⤵
        
        PID:7624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49373.exe
        6⤵
        
        PID:11352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2485.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7521.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18783.exe
        6⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22587.exe
        7⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25003.exe
        8⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18121.exe
        8⤵
        
        PID:10988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2039.exe
        8⤵
        
        PID:452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6481.exe
        7⤵
        
        PID:8484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20181.exe
        7⤵
        
        PID:13668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6141.exe
        6⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57919.exe
        7⤵
        
        PID:10716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15188.exe
        7⤵
        
        PID:15748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26988.exe
        6⤵
        
        PID:9012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12632.exe
        6⤵
        
        PID:13596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59077.exe
        5⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44079.exe
        6⤵
        
        PID:8016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63518.exe
        6⤵
        
        PID:11592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10336.exe
        6⤵
        
        PID:14408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58016.exe
        6⤵
        
        PID:9968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59514.exe
        5⤵
        
        PID:7692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1132.exe
        5⤵
        
        PID:11448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23097.exe
        5⤵
        
        PID:14600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31432.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35363.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17992.exe
        6⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25003.exe
        7⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18121.exe
        7⤵
        
        PID:10760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59408.exe
        7⤵
        
        PID:5132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44146.exe
        6⤵
        
        PID:8740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54329.exe
        6⤵
        
        PID:12608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19652.exe
        6⤵
        
        PID:3484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62062.exe
        5⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60215.exe
        6⤵
        
        PID:6372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14177.exe
        6⤵
        
        PID:2232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59817.exe
        6⤵
        
        PID:14248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16840.exe
        6⤵
        
        PID:4112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19248.exe
        5⤵
        
        PID:8060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12153.exe
        5⤵
        
        PID:11176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6000.exe
        5⤵
        
        PID:15072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14869.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17992.exe
        5⤵
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24199.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34470.exe
        6⤵
        
        PID:8608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44146.exe
        5⤵
        
        PID:8376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54329.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7208.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15628.exe
      4⤵
      PID:5920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8362.exe
        5⤵
        
        PID:6280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57919.exe
        6⤵
        
        PID:10572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61178.exe
        6⤵
        
        PID:14604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56309.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37478.exe
        5⤵
        
        PID:14116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50643.exe
        5⤵
        
        PID:3172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10245.exe
      4⤵
      PID:6488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19591.exe
        5⤵
        
        PID:14444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26836.exe
      4⤵
      PID:9480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65046.exe
      4⤵
      PID:14200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28507.exe
      4⤵
      PID:5324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42201.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42201.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10370.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50931.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45045.exe
        6⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25003.exe
        7⤵
        
        PID:992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18121.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59408.exe
        7⤵
        
        PID:1348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46502.exe
        6⤵
        
        PID:8388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29056.exe
        6⤵
        
        PID:10148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48432.exe
        6⤵
        
        PID:6224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45918.exe
        5⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10054.exe
        6⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3586.exe
        7⤵
        
        PID:11036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33834.exe
        7⤵
        
        PID:15880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60171.exe
        6⤵
        
        PID:10124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2413.exe
        6⤵
        
        PID:14800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45459.exe
        6⤵
        
        PID:8596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6228.exe
        5⤵
        
        PID:7584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37307.exe
        6⤵
        
        PID:10592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35905.exe
        6⤵
        
        PID:14552
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14552 -s 472
        7⤵
        Program crash
        
        PID:5528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11001.exe
        5⤵
        
        PID:10744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26036.exe
        5⤵
        
        PID:14296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34107.exe
        5⤵
        
        PID:6632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14729.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11875.exe
        5⤵
        
        PID:3752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25327.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6110.exe
        7⤵
        
        PID:8160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49943.exe
        8⤵
        
        PID:11312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6149.exe
        7⤵
        
        PID:8912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30372.exe
        7⤵
        
        PID:15244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31976.exe
        7⤵
        
        PID:7900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-669.exe
        6⤵
        
        PID:8168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11908.exe
        6⤵
        
        PID:11896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9953.exe
        6⤵
        
        PID:15952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22460.exe
        5⤵
        
        PID:7032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58635.exe
        6⤵
        
        PID:8832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39117.exe
        6⤵
        
        PID:12348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52392.exe
        6⤵
        
        PID:6768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1769.exe
        5⤵
        
        PID:9076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43989.exe
        5⤵
        
        PID:13624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8705.exe
        5⤵
        
        PID:4808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59653.exe
      4⤵
      PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24891.exe
        5⤵
        
        PID:6624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50275.exe
        6⤵
        
        PID:7252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18121.exe
        6⤵
        
        PID:11200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-970.exe
        6⤵
        
        PID:15736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52558.exe
        5⤵
        
        PID:9220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57129.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14641.exe
      4⤵
      PID:6636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3586.exe
        5⤵
        
        PID:12240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56476.exe
        5⤵
        
        PID:6820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25112.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40481.exe
      4⤵
      PID:14204
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14204 -s 480
        5⤵
        Program crash
        
        PID:15988
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15988 -s 8
        6⤵
        Program crash
        
        PID:4956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26634.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26634.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6390.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49151.exe
        5⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15252.exe
        6⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24199.exe
        7⤵
        
        PID:12260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50615.exe
        7⤵
        
        PID:3216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13244.exe
        6⤵
        
        PID:10032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3917.exe
        6⤵
        
        PID:14044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62133.exe
        6⤵
        
        PID:11332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55238.exe
        5⤵
        
        PID:5356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35711.exe
        6⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8682.exe
        7⤵
        
        PID:14420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12951.exe
        7⤵
        
        PID:6332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60171.exe
        6⤵
        
        PID:8684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59817.exe
        6⤵
        
        PID:14256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15164.exe
        5⤵
        
        PID:7956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8453.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6576.exe
        5⤵
        
        PID:14716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-697.exe
      4⤵
      PID:3192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5098.exe
        5⤵
        
        PID:3808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7890.exe
        6⤵
        
        PID:7404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19545.exe
        7⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2501.exe
        6⤵
        
        PID:10448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28836.exe
        6⤵
        
        PID:14220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59308.exe
        6⤵
        
        PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64034.exe
        5⤵
        
        PID:8048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56539.exe
        6⤵
        
        PID:14172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41731.exe
        6⤵
        
        PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6288.exe
        5⤵
        
        PID:11160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14665.exe
        5⤵
        
        PID:14956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45459.exe
        5⤵
        
        PID:11192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32408.exe
      4⤵
      PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56331.exe
        5⤵
        
        PID:7904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11001.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31908.exe
        5⤵
        
        PID:15684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-839.exe
        5⤵
        
        PID:2108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51049.exe
      4⤵
      PID:9004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33517.exe
      4⤵
      PID:12388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13988.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13988.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20563.exe
      4⤵
      PID:2524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15252.exe
        5⤵
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45475.exe
        6⤵
        
        PID:10312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57094.exe
        6⤵
        
        PID:14432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30194.exe
        6⤵
        
        PID:7940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31894.exe
        5⤵
        
        PID:8480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54329.exe
        5⤵
        
        PID:12616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57753.exe
        5⤵
        
        PID:6996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43369.exe
      4⤵
      PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42299.exe
        5⤵
        
        PID:8872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39117.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59984.exe
        5⤵
        
        PID:15472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59714.exe
      4⤵
      PID:8996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54137.exe
      4⤵
      PID:11224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43531.exe
      4⤵
      PID:16172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40213.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40213.exe
    3⤵
    PID:1660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-246.exe
      4⤵
      PID:5636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38451.exe
        5⤵
        
        PID:6984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57919.exe
        6⤵
        
        PID:10684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61178.exe
        6⤵
        
        PID:14504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11551.exe
        6⤵
        
        PID:16296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29781.exe
        5⤵
        
        PID:9236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4996.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19723.exe
        5⤵
        
        PID:1740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16613.exe
      4⤵
      PID:7276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29479.exe
        5⤵
        
        PID:6964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53569.exe
      4⤵
      PID:10332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63290.exe
      4⤵
      PID:13236
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13236 -s 464
        5⤵
        Program crash
        
        PID:15876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40415.exe
      4⤵
      PID:15764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30139.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30139.exe
    3⤵
    PID:5620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52247.exe
      4⤵
      PID:8080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11001.exe
      4⤵
      PID:11480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10336.exe
      4⤵
      PID:14756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27744.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27744.exe
    3⤵
    PID:7208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37017.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37017.exe
    3⤵
    PID:11692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56174.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56174.exe
    3⤵
    PID:15404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2795.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2795.exe
    3⤵
    PID:5528
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51714.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51714.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25643.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25643.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9860.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42955.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1080.exe
        6⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25003.exe
        7⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18121.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-970.exe
        7⤵
        
        PID:15744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26082.exe
        6⤵
        
        PID:8464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29056.exe
        6⤵
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60685.exe
        6⤵
        
        PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21116.exe
        5⤵
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42299.exe
        6⤵
        
        PID:8800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39117.exe
        6⤵
        
        PID:12316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43215.exe
        6⤵
        
        PID:11444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46502.exe
        5⤵
        
        PID:8400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29056.exe
        5⤵
        
        PID:8344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59986.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11491.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26671.exe
        6⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36627.exe
        7⤵
        
        PID:9936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31525.exe
        7⤵
        
        PID:13120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50807.exe
        7⤵
        
        PID:8612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6481.exe
        6⤵
        
        PID:8640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56937.exe
        6⤵
        
        PID:12396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7904.exe
        6⤵
        
        PID:2468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6141.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39471.exe
        6⤵
        
        PID:10948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65070.exe
        6⤵
        
        PID:14196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10975.exe
        6⤵
        
        PID:7148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26988.exe
        5⤵
        
        PID:8984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7161.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56853.exe
      4⤵
      PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21383.exe
        5⤵
        
        PID:6172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13710.exe
        6⤵
        
        PID:8844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39117.exe
        6⤵
        
        PID:12164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11551.exe
        6⤵
        
        PID:6708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12293.exe
        5⤵
        
        PID:8436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57129.exe
        5⤵
        
        PID:12584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7904.exe
        5⤵
        
        PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34749.exe
      4⤵
      PID:7164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39819.exe
        5⤵
        
        PID:14344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6099.exe
      4⤵
      PID:10196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36016.exe
      4⤵
      PID:14188
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14188 -s 464
        5⤵
        Program crash
        
        PID:15968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44505.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44505.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29395.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47807.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16007.exe
        6⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43199.exe
        7⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25003.exe
        8⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18121.exe
        8⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26543.exe
        8⤵
        
        PID:4920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48362.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60355.exe
        5⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19847.exe
        6⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13518.exe
        7⤵
        
        PID:8692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34702.exe
        7⤵
        
        PID:13224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35310.exe
        7⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63850.exe
        6⤵
        
        PID:8544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47601.exe
        6⤵
        
        PID:7504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25076.exe
        6⤵
        
        PID:14124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6141.exe
        5⤵
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16031.exe
        6⤵
        
        PID:3068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21944.exe
        5⤵
        
        PID:9796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40489.exe
        5⤵
        
        PID:14144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10475.exe
        5⤵
        
        PID:5320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18428.exe
      4⤵
      PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43059.exe
        5⤵
        
        PID:8128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59139.exe
        6⤵
        
        PID:15444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14125.exe
        5⤵
        
        PID:9500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30372.exe
        5⤵
        
        PID:15168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56066.exe
      4⤵
      PID:7936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21936.exe
      4⤵
      PID:11504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3253.exe
      4⤵
      PID:14780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16877.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16877.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10858.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19515.exe
        5⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34175.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53171.exe
        7⤵
        
        PID:11676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39273.exe
        7⤵
        
        PID:16328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8209.exe
        6⤵
        
        PID:9760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24648.exe
        6⤵
        
        PID:13008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21500.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16613.exe
        5⤵
        
        PID:7268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23291.exe
        6⤵
        
        PID:14908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61738.exe
        5⤵
        
        PID:10284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6576.exe
        5⤵
        
        PID:14736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12564.exe
      4⤵
      PID:6608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33695.exe
        5⤵
        
        PID:10208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16149.exe
        5⤵
        
        PID:60
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2231.exe
        5⤵
        
        PID:15876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17913.exe
      4⤵
      PID:8528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50053.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33056.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6204.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6204.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60355.exe
      4⤵
      PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23931.exe
        5⤵
        
        PID:6756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4582.exe
        6⤵
        
        PID:1068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27759.exe
        7⤵
        
        PID:14584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42499.exe
        7⤵
        
        PID:8092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18121.exe
        6⤵
        
        PID:6048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59792.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63850.exe
        5⤵
        
        PID:8552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47601.exe
        5⤵
        
        PID:9304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51894.exe
        5⤵
        
        PID:13400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60835.exe
        5⤵
        
        PID:7876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6141.exe
      4⤵
      PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42299.exe
        5⤵
        
        PID:8764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63325.exe
        5⤵
        
        PID:13600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21944.exe
      4⤵
      PID:9696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63186.exe
      4⤵
      PID:12968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20473.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20473.exe
    3⤵
    PID:5972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28311.exe
      4⤵
      PID:7544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32367.exe
        5⤵
        
        PID:10860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10975.exe
        5⤵
        
        PID:3624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61022.exe
      4⤵
      PID:10704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28836.exe
      4⤵
      PID:13244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46197.exe
      4⤵
      PID:4780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62863.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62863.exe
    3⤵
    PID:6416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61621.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61621.exe
    3⤵
    PID:10556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1237.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1237.exe
    3⤵
    PID:15112
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11344.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11344.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11382.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11382.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55487.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63183.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41751.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47283.exe
        7⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-830.exe
        8⤵
        
        PID:10108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15189.exe
        8⤵
        
        PID:13228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51301.exe
        7⤵
        
        PID:9632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28428.exe
        7⤵
        
        PID:13480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27903.exe
        7⤵
        
        PID:9528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6141.exe
        6⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61619.exe
        7⤵
        
        PID:11076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39989.exe
        7⤵
        
        PID:14856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21944.exe
        6⤵
        
        PID:9744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15984.exe
        6⤵
        
        PID:14164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61596.exe
        6⤵
        
        PID:692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19145.exe
        5⤵
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2166.exe
        6⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12314.exe
        7⤵
        
        PID:9576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27633.exe
        7⤵
        
        PID:12852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2397.exe
        6⤵
        
        PID:8444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31856.exe
        6⤵
        
        PID:12156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-120.exe
        6⤵
        
        PID:3652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12594.exe
        6⤵
        
        PID:9884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19876.exe
        5⤵
        
        PID:920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42299.exe
        6⤵
        
        PID:8756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26568.exe
        6⤵
        
        PID:13640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15557.exe
        5⤵
        
        PID:9716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21525.exe
        6⤵
        
        PID:11292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54521.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18813.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39011.exe
        5⤵
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57999.exe
        6⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5970.exe
        7⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6222.exe
        8⤵
        
        PID:10288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27353.exe
        8⤵
        
        PID:14184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40332.exe
        8⤵
        
        PID:13236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1244.exe
        7⤵
        
        PID:11252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2797.exe
        7⤵
        
        PID:14392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53946.exe
        6⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27759.exe
        7⤵
        
        PID:14644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5136.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65289.exe
        6⤵
        
        PID:15212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11435.exe
        6⤵
        
        PID:6628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33229.exe
        5⤵
        
        PID:6892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24759.exe
        6⤵
        
        PID:9176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49014.exe
        6⤵
        
        PID:12356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59792.exe
        6⤵
        
        PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exe
        5⤵
        
        PID:9048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62802.exe
        5⤵
        
        PID:12432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57760.exe
        5⤵
        
        PID:1280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51485.exe
      4⤵
      PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49647.exe
        5⤵
        
        PID:9504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3513.exe
        5⤵
        
        PID:13332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52392.exe
        5⤵
        
        PID:15792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18673.exe
      4⤵
      PID:7648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7669.exe
      4⤵
      PID:11464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29642.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56042.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56042.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1730.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29005.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58679.exe
        6⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4250.exe
        7⤵
        
        PID:11028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39989.exe
        7⤵
        
        PID:14728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8209.exe
        6⤵
        
        PID:9824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49154.exe
        6⤵
        
        PID:14132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23310.exe
        6⤵
        
        PID:7884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9929.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32803.exe
        6⤵
        
        PID:14932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12616.exe
        5⤵
        
        PID:11228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43709.exe
        5⤵
        
        PID:15088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57281.exe
        5⤵
        
        PID:5740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-225.exe
      4⤵
      PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2166.exe
        5⤵
        
        PID:6572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12122.exe
        6⤵
        
        PID:9508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59346.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53443.exe
        6⤵
        
        PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51301.exe
        5⤵
        
        PID:9616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11900.exe
        5⤵
        
        PID:12780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28046.exe
      4⤵
      PID:7396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58599.exe
        5⤵
        
        PID:12720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17520.exe
      4⤵
      PID:10676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9501.exe
      4⤵
      PID:2896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51173.exe
      4⤵
      PID:3680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24380.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24380.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11491.exe
      4⤵
      PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22587.exe
        5⤵
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45423.exe
        6⤵
        
        PID:7832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52418.exe
        6⤵
        
        PID:11684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15572.exe
        6⤵
        
        PID:15420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49080.exe
        6⤵
        
        PID:6696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6481.exe
        5⤵
        
        PID:8472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52853.exe
        5⤵
        
        PID:12476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32409.exe
        5⤵
        
        PID:4792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6141.exe
      4⤵
      PID:7056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17515.exe
        5⤵
        
        PID:10300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43689.exe
        5⤵
        
        PID:14108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11551.exe
        5⤵
        
        PID:6712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26988.exe
      4⤵
      PID:8656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7161.exe
      4⤵
      PID:12708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50643.exe
      4⤵
      PID:16348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65518.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65518.exe
    3⤵
    PID:5644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31627.exe
      4⤵
      PID:6596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19591.exe
        5⤵
        
        PID:14896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14177.exe
      4⤵
      PID:9296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46213.exe
      4⤵
      PID:15900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15760.exe
      4⤵
      PID:5224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16448.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16448.exe
    3⤵
    PID:8188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39819.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-549.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-549.exe
    3⤵
    PID:11420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48331.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48331.exe
    3⤵
    PID:14400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60254.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60254.exe
    3⤵
    PID:7240
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48066.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48066.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26899.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26899.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5814.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62498.exe
        5⤵
        
        PID:6396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9626.exe
        6⤵
        
        PID:8860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39117.exe
        6⤵
        
        PID:1048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47299.exe
        6⤵
        
        PID:6724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6892.exe
        5⤵
        
        PID:9752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37985.exe
        5⤵
        
        PID:12976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37749.exe
      4⤵
      PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50511.exe
        5⤵
        
        PID:6600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40239.exe
        6⤵
        
        PID:10116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31908.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8209.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16480.exe
        5⤵
        
        PID:13052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14191.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5844.exe
      4⤵
      PID:7384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19591.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45432.exe
        5⤵
        
        PID:7812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26186.exe
      4⤵
      PID:10632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26036.exe
      4⤵
      PID:14236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10645.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10645.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14890.exe
      4⤵
      PID:1824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55451.exe
        5⤵
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19575.exe
        6⤵
        
        PID:6672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51266.exe
        6⤵
        
        PID:11560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10336.exe
        6⤵
        
        PID:14368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19723.exe
        6⤵
        
        PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6481.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20181.exe
        5⤵
        
        PID:13660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6141.exe
      4⤵
      PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16783.exe
        5⤵
        
        PID:8908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56798.exe
        5⤵
        
        PID:13472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21944.exe
      4⤵
      PID:9684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22346.exe
      4⤵
      PID:13060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35310.exe
      4⤵
      PID:5208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46825.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46825.exe
    3⤵
    PID:5768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35711.exe
      4⤵
      PID:5096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60171.exe
      4⤵
      PID:9028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54528.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21029.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21029.exe
    3⤵
    PID:7976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15506.exe
      4⤵
      PID:15040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33563.exe
      4⤵
      PID:7880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65325.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65325.exe
    3⤵
    PID:10456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55578.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55578.exe
    3⤵
    PID:14492
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34304.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34304.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50931.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50931.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37091.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11081.exe
        5⤵
        
        PID:6640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5542.exe
        6⤵
        
        PID:9020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39117.exe
        6⤵
        
        PID:10320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63635.exe
        6⤵
        
        PID:10440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12048.exe
        5⤵
        
        PID:8536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58718.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31034.exe
        5⤵
        
        PID:4060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22949.exe
      4⤵
      PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11982.exe
        5⤵
        
        PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48526.exe
        5⤵
        
        PID:11732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3320.exe
        5⤵
        
        PID:15516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51545.exe
      4⤵
      PID:7256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6481.exe
      4⤵
      PID:11668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12772.exe
      4⤵
      PID:1912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42497.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42497.exe
    3⤵
    PID:2240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62467.exe
      4⤵
      PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30475.exe
        5⤵
        
        PID:6400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33695.exe
        6⤵
        
        PID:10200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44021.exe
        6⤵
        
        PID:13348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43976.exe
        6⤵
        
        PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1244.exe
        5⤵
        
        PID:11260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56082.exe
        5⤵
        
        PID:14624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57519.exe
        5⤵
        
        PID:8024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-661.exe
      4⤵
      PID:7616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57919.exe
        5⤵
        
        PID:10932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15188.exe
        5⤵
        
        PID:15768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46197.exe
        5⤵
        
        PID:7136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5136.exe
      4⤵
      PID:10764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34702.exe
      4⤵
      PID:12660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23280.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23280.exe
    3⤵
    PID:6028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44271.exe
      4⤵
      PID:8056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55350.exe
      4⤵
      PID:11608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10336.exe
      4⤵
      PID:15348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8431.exe
      4⤵
      PID:9204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57410.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57410.exe
    3⤵
    PID:7536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55185.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55185.exe
    3⤵
    PID:11712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61774.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61774.exe
    3⤵
    PID:14976
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5045.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5045.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11491.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11491.exe
    3⤵
    PID:2936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58767.exe
      4⤵
      PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40179.exe
        5⤵
        
        PID:7512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26607.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8099.exe
        6⤵
        
        PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40601.exe
        5⤵
        
        PID:10696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28836.exe
        5⤵
        
        PID:14268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42077.exe
      4⤵
      PID:7572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62735.exe
        5⤵
        
        PID:15528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62121.exe
      4⤵
      PID:11048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1453.exe
      4⤵
      PID:1232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57519.exe
      4⤵
      PID:10644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33229.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33229.exe
    3⤵
    PID:6900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20535.exe
      4⤵
      PID:8148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63710.exe
      4⤵
      PID:11640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30948.exe
      4⤵
      PID:4276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60865.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60865.exe
    3⤵
    PID:8788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62802.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62802.exe
    3⤵
    PID:12452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49592.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49592.exe
    3⤵
    PID:6452
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24326.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24326.exe
  2⤵
  PID:5888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25003.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25003.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18121.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18121.exe
    3⤵
    PID:10044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39180.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39180.exe
    3⤵
    PID:5144
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26400.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26400.exe
  2⤵
  PID:7920
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61138.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61138.exe
  2⤵
  PID:11512
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50937.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50937.exe
  2⤵
  PID:14364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 13236 -ip 13236
1⤵
PID:15832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 14552 -ip 14552
1⤵
PID:16172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 660 -ip 660
1⤵
PID:512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 2896 -ip 2896
1⤵
PID:632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 1232 -ip 1232
1⤵
PID:11704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 13236 -ip 13236
1⤵
PID:8772

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10370.exe

Filesize
468KB

MD5
5cef40df1a97355f7e331900aed4784f

SHA1
f8ac2736799287abf5b6253077383f439baa2eb7

SHA256
d89b2753d98c44c223ca1fa811badb50eae221c86d9da1ecaf750d7d219f295b

SHA512
f63eee7cad7c4f653c78b65723258bda63547906d38abc54c5fc2fcf6d5b4bd62b999468a34526f17520381c9981d7b7e5693199f426128f88c56888de1bb981

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11344.exe

Filesize
468KB

MD5
e1149a55d47212ebe6a05c1a27d52a9f

SHA1
bc38d3530695dff745600c5eee76406a4a52823d

SHA256
05b86fd3b8f59d3232dbaf9d2c481f6902af880608c659ca58a4ff727a8c490e

SHA512
7ca8de00ac29e95f67764c9d78e8a8a965edc47d4e112b3d646c87ed44ae1c416a33e14b5841b1b735b39d15bf88670160b52f6cc2f7320f835c634aa84729a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1138.exe

Filesize
468KB

MD5
c35f7d6154219b159d91af12ec43de96

SHA1
53f0b7fae521924f99378249a99a4e2e156ad375

SHA256
a541adc5f18a178761831a96b4ffc64be592947e3c0bbc13dadfe2b045554326

SHA512
b3f1eca5e6890acf9b9b9194df8fc886ff3658fc54d65ce530019446ce5c16dfb9693a1ec4a91a3019e6677187f9d04d7c251b75ebb5dc16585e31c6f93c432f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11382.exe

Filesize
468KB

MD5
e4b1c372d6eb9c482e038e9f0f8f9400

SHA1
16f0588382fda8c8dcabdaa7ae4aebbef371f369

SHA256
9b72ffc70e9d2b9adc827698320164b62ac04da74dafb9785d943d21719f3796

SHA512
ba98f8af62b18c60d81b118b94277fb23c47913ad04b0db1fd4f88bb933c746bfb57365bf6f24eb1a8d7ad84abc1b8ea0f82712f5c16b664b30686b680d30c27

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14454.exe

Filesize
468KB

MD5
a9613f30206cb594ba11bca07a66cfad

SHA1
051bfeb048f20a2b03e9a7d086f444038f5d6b1b

SHA256
81728874fe45bccea08a0acbc1bb1b4215f369adac336bc4265384d473290db0

SHA512
e7d270191567e39d93870b321728c4887204646968c35b08a8154b3a783d2a2079d629a16c90218f1a9150d6ef18a6197db9f3d5b4f60dd27226a1b9de7251bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16877.exe

Filesize
468KB

MD5
c925bf90c9f075c34bdcc1b1039fef73

SHA1
d95eda346d76a4c41df355f1bbaf598bc09d0097

SHA256
9b4d35c2acac5ff95da4d04f4680e3a4f3e93a4979a70abd9ec63192a2919d84

SHA512
feb6617c78d28b6bdbba457f51031b68d8018d37320cf74f45ebe97ff43c2b05167f3e032e651046994c9a17ef31fd750dc48aa7d4e8732273b815561b1bcd2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16951.exe

Filesize
468KB

MD5
85168d0a08d9ee46c80ad855f64a357b

SHA1
575180bdce736a472155e72fc429a45957e629c3

SHA256
c32b2dc81779184958795ad5bbeba1043f24cced3126171853fe711e39e2f1d5

SHA512
f526752c5ba074b788017686d92b06ddd34fcdfc993517fa431d27ab5bbf17887a8fe0135761679bd701c0bbcaba063e72159a1865a023ad55ec5391c71ae225

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20768.exe

Filesize
468KB

MD5
670b251717d972e086f1b5ac45ec541c

SHA1
7bb113c55b30a543569b7c04db9d7cbe1afbeeef

SHA256
a8e8b451998f02fb8549d019d7e9342410c33d9489cfa26b5a0e60c600334802

SHA512
b31d3e9d9ebb5cdf4956740a2237d28b64ac20471c072738e1478369259ae33494035a1f185a7e3acfa4caa2ef3bebb3a8e13bf0ea5023e0eb0a3aae34c6fbd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25643.exe

Filesize
468KB

MD5
5616379b482749008099a43eeb46e1d1

SHA1
66e981d86fc1f59a43b3410707787ab6aa3beaa2

SHA256
69259fb90b1213c89e60b503e77ef8c5bb503abc9664613d7dac79f2f80ee9e5

SHA512
60be049b846501b534cf29b6da5562b132ed6d1feb23bf5f5f2d9ddd83f2e9cd12e4389ec3adedcf84cc7d90d3245fa34edbf1cd0f3df01a3c2f3629b4597e7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26634.exe

Filesize
468KB

MD5
78438930d9ff7337d28ccd3186395d9d

SHA1
1330af9957ed32df7d66396a8d33bbd28b608b17

SHA256
4ba3db903dacca4e7de32f2867f887a7362cb4be0860e8fa8923d2426a8a4af8

SHA512
771e1cfa57c17696da57afa06831e698112615ad6cc8e212cf810190d337a1dd71c0595b9da4a073022ecff2fff8409aa308b4341140fab68be3eeb3842c6386

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26899.exe

Filesize
468KB

MD5
9d76b18795503c35cd016739b4b02251

SHA1
4f8a914b767f10070b38d78cc96a9c71b735cfb1

SHA256
72c7490a4388c8d56960c57671c031091ffbb987b6dfbcc77cc64bfe9d7db554

SHA512
6502cb84d54988416085221ff66fbccb9c15a15095aa37a5a0d46c4d07d22e40d31a464626c4edd4ce157b83de35bf878f410da4a0f0d7ea95e4a2c0ca99babd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27353.exe

Filesize
468KB

MD5
6af093728648adcd699b9f6032dd00ed

SHA1
919479c4195aa87dfb756c0b2ebb48791d8aca4c

SHA256
d90bd27bfdd3157e5a2f23f6086040a230d4d04f2ce5719cf9a75dbde417c68c

SHA512
bc8e97a98e8e9f3b94cdc454c3892034e6d5423b5e2652beb46ea00bc6b06a348828e661178aea641a379bbd17e56c92fc78186cb3a0c5e4b047da0b2aab9c3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28087.exe

Filesize
468KB

MD5
e0e33f4af0ca8b1839aaba1ff3fe7628

SHA1
c340ac128c902268982e95b279248995721ad0f2

SHA256
3b6e337870548f96e715177e6ea08e8b706609638ab5797d225cc2dbc96450a1

SHA512
c6639948144fb91384d00e353592a34fd6ff3dc45b95f839166736e454626469a7f91b0778bc999c8bb44161d3a4381ce295efbd34965d3a2c60941782bcf01b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28465.exe

Filesize
468KB

MD5
057e87404a2eb2e988c78f9bc3117a7d

SHA1
76c0f327773ea3c943f0a72e103f96cdda5bdf10

SHA256
5da4e59643ae41363ec82f123b529a1b82f5b43409363835fdf50169c32f7e01

SHA512
b7cce05fea0082e8b8348a3b08bc27dd7229a6ebfa0e225b6965b07c9e790b0a66b287911db01f482e4e85f1f2e5e11c5dfbfb6eb1ca90bc2944193cdcbadb5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29395.exe

Filesize
468KB

MD5
5a6775ffce24ed8f5ad09a5f3cda0f7a

SHA1
2f1fd36af0dc7edc289e5a44f90e3d34d247e2b3

SHA256
17684da67e2a6bf6ee42d19118124a512c5f672d548e0df4f9e2e875a8bb9d6a

SHA512
daad0f5c9d98f1aa81f484e802223bbb94a76e1756f30d72feaf3ad7bece6fb28b1d654baa7ad3f6a1a2facce47b55bc86734618f96685d85b2a092c3a8162ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31345.exe

Filesize
468KB

MD5
d1a46edbdb2c784df088245219f9cbac

SHA1
e03b1e919cc0b90383d3a02e713c11ec988269b7

SHA256
d915d37a0cbc9da079c3fabc14d52e74453109262e3beded3bd4eadecc757b56

SHA512
d1fe22eb481ee035787e101622d551e8892f3287edf5967dff026eb8c18d3224912bda75ff19dea6becd2b8b387c200a764e53eb32f3e1a57ec644835a2b4b50

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31432.exe

Filesize
468KB

MD5
f9524585a4e321954d9c633b3ac83c18

SHA1
d6bc85fab99d49bf51a1a25dc7884aec07a0e6f8

SHA256
563398760815aa26e40ce584c4c62b1ee248ec47635e671821b767658782ff24

SHA512
3cf09540dfa64bf04e880468ff31c205c95936643bc19c6864875a69f217e3087feda3a92226f0c405dd19f7c4f0ee07dd78514d99e6ee9a4d93f73462233362

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34304.exe

Filesize
468KB

MD5
1900788ba4276a9316d02d97eb14209e

SHA1
66e61f997e3e96fb9ebc4981146a2f7b3fe7e0f7

SHA256
c5a0cfdf41dd5bc0184a43b1fa94a07371b529cb5bc8ab8df6cbed539d1959e7

SHA512
863984cbd55ff5353464d7713cb0cf233ca69a2a2b23389475286806633abad2c63577ada4437bb46496098c5d08f946c0345452389320b5ab3e8aa6dc82a1db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34875.exe

Filesize
468KB

MD5
8ee45c218019891783a6cd3ca627d44d

SHA1
04a78da757537b65b11145e4eda4929629a977eb

SHA256
c9d3fad592a4d76619474b8c97f41b3213fb38bd9e8aa55fc4499e94aba7438b

SHA512
c5754606cbcc55a57e04f3404e324bc9618a54d1e6832fbb3ba46eaa52a64f119060756e14cf2646b5e3d7fbf18c3743f19f7792e0c69269bb3c5cd764b35427

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42201.exe

Filesize
468KB

MD5
ad08aaf37859a19b4d70631ec46f14b3

SHA1
a9717293faf7afbf763295f682aef61b55765cc3

SHA256
17afded4e0657956648b0fc624dd3645c324d9104838e502e4c9db7a7d72dfbb

SHA512
90b17e8cb8108a17ace3e7541fcfddda87b903ceacb2ebeb1aa7140c1a35dba449639ad43811435d5abb6b141d5e10237ff4b73ffa85801a274a3b36c4e628ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44505.exe

Filesize
468KB

MD5
daa0dd4ea90e0e7433b29f83e3542450

SHA1
8f376f45505529f7f2d5c0a1837f308e7650aef1

SHA256
927a76af0ca9024e1e54360a1dc941c82d60c694e81e3d0eb1b62675e2ac8695

SHA512
c82c40ad79ae8e4ea9da1e343e06e2961fb2c9a6f7b5c5b9664648cd72617adca1213bf65742612ceb772ccdaf814011bea43490a0cac0c866206234034f5dc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46883.exe

Filesize
468KB

MD5
beebac6f5c726f47d3c58bcba07b2774

SHA1
84867f2339e39afb0db6194befe32975f31229bb

SHA256
f9dcb54c4843a30c8ac4e5bd46be3e2adf9b1941c9eb9e8f0b6ce1ff37a65f63

SHA512
33cc877dd74bac1c8e3c74defe165b8667410505f80b0693e863cca7a6225a04206cb2dc5d661595f08e1a51dd907b4686ff35b4772f0c261fbab318c8b80c77

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48066.exe

Filesize
468KB

MD5
e8d8ac0e427f3b055277346ab2c46d9e

SHA1
3870a3b5c2b29909374bbd8cf53b38e915fcbeb0

SHA256
64802ecb96a8798dced4a5b9b51b8271753825e93941c2c519df962e4af87b26

SHA512
04efcffe0d5d702c0d23c4a81d3a7fbabc9ad0cd8ade4a9ca5961e43a636a65f98948df1421be74e9ba8159f26ed503dee81e7e3d3e2a7715730dd51a743df22

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50547.exe

Filesize
468KB

MD5
e184cf6d4cce7f36393b8128e78200f3

SHA1
a95f0ceb9f0ffd1056d816f6cee8aa3a9700faaa

SHA256
478ae986a61ac5c9a5036cf77c45afe9f712fb4b86e5c7d6753b18e17a5356a0

SHA512
d2f3089f7735cea7bcb1a77ff5869fb6de0562741e4b28fdc5f856172bfe1f8ead038e6a8967862c66ee58319d794c1fe16e0f1c00d0a09b9e6dc3676498ad0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51714.exe

Filesize
468KB

MD5
287d668a3fed9470092f7a548e2f62a6

SHA1
59192eb7fe8cc5b501603f8aa3cec0093411b781

SHA256
1541aa8dc88af6e74e9d3760a6fa50b62c7651e08d95ef84b7a1b5889a6d42ea

SHA512
430f9a096f878915ba8c416cbe98054a11ccd2e65813e16507b220125250d40bcb5bd2d353905117180f68b8199ca6d96e39084a9a0629e28b6fab98656cd057

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55487.exe

Filesize
468KB

MD5
0c53b0aa4fb950f180cbbf084e2b2a11

SHA1
14a90425a2e1beb43dbcd42a6a0d2d264e748ed4

SHA256
13fce746624df6dc914ed16e93013961a55c98bb6b6bd243d825875a9b70f6a5

SHA512
c3cc45dccadd210a364b8361b69654a4ba44966542ba7eb1979fc5f33066b2d7636f0dda881195386e719067e7a93a75652ac27fe606b6bf30a65b145b486d83

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56042.exe

Filesize
468KB

MD5
5c6716641da43fdcf435540a618f939b

SHA1
b8cb1e2a84cb14c77604515213bef616b1e1542e

SHA256
aa6b3f4abaeb94a51fe0178a4f4114a10a6584c3fe18ee1c5d167fede4a44218

SHA512
e545d0c75696bf2252482c265598ab5eb4cf1bba41cfbeb8a44327c6e84146a9b0e59c8cc4d7262868690b095a00df1f2cbdf05d59f0b3e35f559e5fc2aa8d00

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56499.exe

Filesize
468KB

MD5
97d204deb2bcecaa37e0ce83c3b95c21

SHA1
73355ef5c84784330c2a76e9e2475717fba9bdc4

SHA256
4439caabbd7cc0c3604f5eaaa25090f8cda7bbc8f50a1b47299146997c5e38a4

SHA512
133202465638015c0f146d3caf6174665d09b16904d48c013bea21b76014765420631387967f15377a9abaab945b28b2b3d63f3e534bce8eaf91766c2b69a174

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5777.exe

Filesize
468KB

MD5
a6dee1fa750c5a55c52a5ea069bde2bb

SHA1
e44b618dc49f21738f212ca0b2e8d66978e3adc0

SHA256
04435fa80bd5cd26fa11faad4d60db4b7d601b6dd9fe09a5bb460e3c9afc475b

SHA512
1127494897af7a1578fe806133492a90f60756846afef60f0457aff85802c2104fa66f118194cb94d6cca8eee5d3d44a095a8515223a37fba0908d2b020dfd63

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59358.exe

Filesize
468KB

MD5
ac63bc8c8afee876f4d0d5bbccbca60f

SHA1
a3bb3ac196e149eafc2231cb32542188a98534f9

SHA256
613c0787a9ca24262d6a8c816ba47184426d59633b0cc3ea6590b545d2797bb6

SHA512
c30940d76fc1eb485c78689511c4650f7dcaab69b15e0e8429674034cf8d3b4d2b9db045bd120e7a48f9f597789a8fa90707c26d1c51df421f3beaedf860aa3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9626.exe

Filesize
468KB

MD5
cbaed5b3c110435fa7c6f476d30d2ceb

SHA1
740eb064b32bf7e327f3a4170377d2335cc70c04

SHA256
1b3c67a58e7579665a0d9bf85ebf452eef2db4c24312f00718b4f6eeba1aec61

SHA512
5a64066f544f57f0ef870a1d29ff38974117d2722d112a9a62c7fedb2469b5319988319a7890426d923116bb519047271f21e68e89b6b8c407bad406c893ecee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9860.exe

Filesize
468KB

MD5
a78cb742260007f9bb1683184eb8ddde

SHA1
303c71b60a1f8ec142274070dc5c9e69e876c7be

SHA256
b31bc2385fab332720643af20ef2244d73a6e0f9fb65327c000d792e6d96ace5

SHA512
946ba56626c7505cd07b40911e5e9500587fa1f2285d4691a7b26e5ff83b0fd7fbec25fb3f09f7465c16015f83edab5c62d8c839adc9f1693ff28d70bbb811dc

Download Submit
memory/368-360-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/392-250-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/448-374-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/744-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/868-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/928-363-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/936-110-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1092-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1096-229-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1196-251-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1200-414-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1212-180-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1228-159-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1236-292-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1344-274-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1444-331-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1500-241-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1556-268-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1660-400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1684-43-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1696-158-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1772-308-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1824-457-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1828-233-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1892-280-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1988-460-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2220-368-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2240-415-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2344-390-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2396-328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2404-154-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2416-252-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2432-361-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2524-396-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2612-358-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2688-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2748-255-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2764-40-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2812-153-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2924-290-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2972-362-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2992-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3036-90-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3192-413-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3304-137-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3392-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3416-96-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3500-455-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3556-133-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3584-334-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3620-21-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3648-458-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3672-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3752-456-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3896-37-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3960-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3976-89-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4016-451-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4212-236-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4252-220-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4372-164-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4376-301-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4380-104-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4428-145-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4440-343-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4444-299-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4452-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4456-209-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4480-459-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4516-454-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4532-187-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4620-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4744-204-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4888-57-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4904-84-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4912-284-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5004-194-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5024-266-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5212-495-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5228-500-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5248-496-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5280-506-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5336-507-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5344-497-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5368-498-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5400-499-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5604-573-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5628-575-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5636-574-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5652-576-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5708-583-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5716-581-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5752-584-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5768-587-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5792-589-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5860-590-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads