cc91fc59216033f30ac5c919345805607690d9ba0f0380d5c68d019114d360fb

Analysis

max time kernel
117s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f2a0e4aadcdee7fd52580fc59adc1ea0N.exe
Size

468KB
MD5

f2a0e4aadcdee7fd52580fc59adc1ea0
SHA1

f861aef56f2cb9d9e1742acba3ccd78eae5bc4da
SHA256

cc91fc59216033f30ac5c919345805607690d9ba0f0380d5c68d019114d360fb
SHA512

bb8a478c28335a2cae37388477186a149e37b98b67e6e38332e957948167ac3af3e4a89c376f18f272f46a05fb301972c1e59d97229c1a7a31f1df759bba88aa
SSDEEP

3072:BqobogCdj0bU2bYBPz59ff8/5MK33XpInmHevV+Cck03x6PNexlL:BqIohqU2iP19ff25SDck6cPNe

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
5032	Unicorn-32845.exe
4244	Unicorn-23691.exe
1240	Unicorn-38635.exe
2248	Unicorn-31641.exe
4920	Unicorn-4998.exe
3592	Unicorn-64405.exe
2484	Unicorn-24027.exe
1184	Unicorn-10006.exe
4716	Unicorn-52985.exe
1524	Unicorn-52720.exe
5040	Unicorn-33119.exe
380	Unicorn-20212.exe
464	Unicorn-56830.exe
396	Unicorn-56830.exe
5000	Unicorn-52091.exe
4116	Unicorn-1428.exe
2320	Unicorn-51184.exe
2332	Unicorn-48491.exe
2488	Unicorn-21849.exe
4624	Unicorn-19802.exe
4724	Unicorn-60743.exe
5088	Unicorn-17002.exe
1628	Unicorn-49046.exe
3508	Unicorn-3109.exe
3284	Unicorn-39529.exe
964	Unicorn-61018.exe
2312	Unicorn-6756.exe
1504	Unicorn-22023.exe
2072	Unicorn-27889.exe
4732	Unicorn-28154.exe
4532	Unicorn-62450.exe
3548	Unicorn-11132.exe
3704	Unicorn-19301.exe
4212	Unicorn-42413.exe
3720	Unicorn-63903.exe
4772	Unicorn-35637.exe
680	Unicorn-28437.exe
5008	Unicorn-29415.exe
4016	Unicorn-6591.exe
3132	Unicorn-6856.exe
4936	Unicorn-45751.exe
2012	Unicorn-49835.exe
1364	Unicorn-19109.exe
4092	Unicorn-23961.exe
4456	Unicorn-4095.exe
384	Unicorn-53925.exe
3452	Unicorn-41473.exe
3632	Unicorn-60809.exe
3264	Unicorn-13353.exe
4576	Unicorn-34843.exe
2448	Unicorn-34843.exe
4652	Unicorn-4116.exe
2644	Unicorn-12284.exe
4148	Unicorn-1978.exe
3720	Unicorn-51734.exe
228	Unicorn-6062.exe
4500	Unicorn-14785.exe
3912	Unicorn-28520.exe
2880	Unicorn-12092.exe
3320	Unicorn-8008.exe
4080	Unicorn-18982.exe
1608	Unicorn-59161.exe
344	Unicorn-53436.exe
264	Unicorn-50262.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
7228	228	WerFault.exe	149
9504	5972	WerFault.exe	191
9496	5964	WerFault.exe	190
10004	6568	WerFault.exe	241
9376	6576	WerFault.exe	242
11440	5832	WerFault.exe	267

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56611.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48379.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45007.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2938.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20461.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1023.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39401.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40741.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46232.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53621.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3888.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24113.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21939.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31135.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64405.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51166.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42177.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23528.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19791.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47752.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42071.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16381.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55659.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17652.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57831.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51898.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37939.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14042.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41430.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3600.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-315.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26506.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-914.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2104.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4238.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57772.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32682.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4614.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14037.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29501.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19387.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23683.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28106.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5431.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39142.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11861.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27672.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6433.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5733.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44773.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1846.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9199.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6591.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34219.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	4644	dwm.exe
Token: SeChangeNotifyPrivilege	4644	dwm.exe
Token: 33	4644	dwm.exe
Token: SeIncBasePriorityPrivilege	4644	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2112	f2a0e4aadcdee7fd52580fc59adc1ea0N.exe
5032	Unicorn-32845.exe
1240	Unicorn-38635.exe
4244	Unicorn-23691.exe
4920	Unicorn-4998.exe
2248	Unicorn-31641.exe
3592	Unicorn-64405.exe
2484	Unicorn-24027.exe
1184	Unicorn-10006.exe
1524	Unicorn-52720.exe
4716	Unicorn-52985.exe
5040	Unicorn-33119.exe
380	Unicorn-20212.exe
396	Unicorn-56830.exe
464	Unicorn-56830.exe
5000	Unicorn-52091.exe
4116	Unicorn-1428.exe
2320	Unicorn-51184.exe
4724	Unicorn-60743.exe
5088	Unicorn-17002.exe
4624	Unicorn-19802.exe
1628	Unicorn-49046.exe
2332	Unicorn-48491.exe
3508	Unicorn-3109.exe
2488	Unicorn-21849.exe
3284	Unicorn-39529.exe
2312	Unicorn-6756.exe
964	Unicorn-61018.exe
2072	Unicorn-27889.exe
4732	Unicorn-28154.exe
1504	Unicorn-22023.exe
4532	Unicorn-62450.exe
3704	Unicorn-19301.exe
3548	Unicorn-11132.exe
4212	Unicorn-42413.exe
680	Unicorn-28437.exe
4772	Unicorn-35637.exe
5008	Unicorn-29415.exe
4016	Unicorn-6591.exe
3132	Unicorn-6856.exe
2012	Unicorn-49835.exe
4936	Unicorn-45751.exe
4456	Unicorn-4095.exe
384	Unicorn-53925.exe
3632	Unicorn-60809.exe
1364	Unicorn-19109.exe
3264	Unicorn-13353.exe
4652	Unicorn-4116.exe
4576	Unicorn-34843.exe
2644	Unicorn-12284.exe
2448	Unicorn-34843.exe
3720	Unicorn-51734.exe
4148	Unicorn-1978.exe
228	Unicorn-6062.exe
4500	Unicorn-14785.exe
2880	Unicorn-12092.exe
3912	Unicorn-28520.exe
3320	Unicorn-8008.exe
1608	Unicorn-59161.exe
344	Unicorn-53436.exe
4080	Unicorn-18982.exe
3976	Unicorn-64370.exe
2844	Unicorn-53509.exe
2700	Unicorn-8392.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 5032	2112	f2a0e4aadcdee7fd52580fc59adc1ea0N.exe	89
PID 2112 wrote to memory of 5032	2112	f2a0e4aadcdee7fd52580fc59adc1ea0N.exe	89
PID 2112 wrote to memory of 5032	2112	f2a0e4aadcdee7fd52580fc59adc1ea0N.exe	89
PID 5032 wrote to memory of 4244	5032	Unicorn-32845.exe	92
PID 5032 wrote to memory of 4244	5032	Unicorn-32845.exe	92
PID 5032 wrote to memory of 4244	5032	Unicorn-32845.exe	92
PID 2112 wrote to memory of 1240	2112	f2a0e4aadcdee7fd52580fc59adc1ea0N.exe	93
PID 2112 wrote to memory of 1240	2112	f2a0e4aadcdee7fd52580fc59adc1ea0N.exe	93
PID 2112 wrote to memory of 1240	2112	f2a0e4aadcdee7fd52580fc59adc1ea0N.exe	93
PID 1240 wrote to memory of 2248	1240	Unicorn-38635.exe	97
PID 1240 wrote to memory of 2248	1240	Unicorn-38635.exe	97
PID 1240 wrote to memory of 2248	1240	Unicorn-38635.exe	97
PID 4244 wrote to memory of 4920	4244	Unicorn-23691.exe	99
PID 4244 wrote to memory of 4920	4244	Unicorn-23691.exe	99
PID 4244 wrote to memory of 4920	4244	Unicorn-23691.exe	99
PID 2112 wrote to memory of 3592	2112	f2a0e4aadcdee7fd52580fc59adc1ea0N.exe	98
PID 2112 wrote to memory of 3592	2112	f2a0e4aadcdee7fd52580fc59adc1ea0N.exe	98
PID 2112 wrote to memory of 3592	2112	f2a0e4aadcdee7fd52580fc59adc1ea0N.exe	98
PID 5032 wrote to memory of 2484	5032	Unicorn-32845.exe	100
PID 5032 wrote to memory of 2484	5032	Unicorn-32845.exe	100
PID 5032 wrote to memory of 2484	5032	Unicorn-32845.exe	100
PID 2248 wrote to memory of 1184	2248	Unicorn-31641.exe	101
PID 2248 wrote to memory of 1184	2248	Unicorn-31641.exe	101
PID 2248 wrote to memory of 1184	2248	Unicorn-31641.exe	101
PID 2484 wrote to memory of 4716	2484	Unicorn-24027.exe	102
PID 2484 wrote to memory of 4716	2484	Unicorn-24027.exe	102
PID 2484 wrote to memory of 4716	2484	Unicorn-24027.exe	102
PID 2112 wrote to memory of 1524	2112	f2a0e4aadcdee7fd52580fc59adc1ea0N.exe	103
PID 2112 wrote to memory of 1524	2112	f2a0e4aadcdee7fd52580fc59adc1ea0N.exe	103
PID 2112 wrote to memory of 1524	2112	f2a0e4aadcdee7fd52580fc59adc1ea0N.exe	103
PID 1240 wrote to memory of 5040	1240	Unicorn-38635.exe	104
PID 1240 wrote to memory of 5040	1240	Unicorn-38635.exe	104
PID 1240 wrote to memory of 5040	1240	Unicorn-38635.exe	104
PID 5032 wrote to memory of 380	5032	Unicorn-32845.exe	105
PID 5032 wrote to memory of 380	5032	Unicorn-32845.exe	105
PID 5032 wrote to memory of 380	5032	Unicorn-32845.exe	105
PID 4920 wrote to memory of 464	4920	Unicorn-4998.exe	106
PID 4920 wrote to memory of 464	4920	Unicorn-4998.exe	106
PID 4920 wrote to memory of 464	4920	Unicorn-4998.exe	106
PID 3592 wrote to memory of 396	3592	Unicorn-64405.exe	107
PID 3592 wrote to memory of 396	3592	Unicorn-64405.exe	107
PID 3592 wrote to memory of 396	3592	Unicorn-64405.exe	107
PID 4244 wrote to memory of 5000	4244	Unicorn-23691.exe	108
PID 4244 wrote to memory of 5000	4244	Unicorn-23691.exe	108
PID 4244 wrote to memory of 5000	4244	Unicorn-23691.exe	108
PID 1184 wrote to memory of 4116	1184	Unicorn-10006.exe	109
PID 1184 wrote to memory of 4116	1184	Unicorn-10006.exe	109
PID 1184 wrote to memory of 4116	1184	Unicorn-10006.exe	109
PID 2248 wrote to memory of 2320	2248	Unicorn-31641.exe	110
PID 2248 wrote to memory of 2320	2248	Unicorn-31641.exe	110
PID 2248 wrote to memory of 2320	2248	Unicorn-31641.exe	110
PID 1524 wrote to memory of 2332	1524	Unicorn-52720.exe	111
PID 1524 wrote to memory of 2332	1524	Unicorn-52720.exe	111
PID 1524 wrote to memory of 2332	1524	Unicorn-52720.exe	111
PID 5040 wrote to memory of 2488	5040	Unicorn-33119.exe	112
PID 5040 wrote to memory of 2488	5040	Unicorn-33119.exe	112
PID 5040 wrote to memory of 2488	5040	Unicorn-33119.exe	112
PID 1240 wrote to memory of 4624	1240	Unicorn-38635.exe	113
PID 1240 wrote to memory of 4624	1240	Unicorn-38635.exe	113
PID 1240 wrote to memory of 4624	1240	Unicorn-38635.exe	113
PID 2112 wrote to memory of 5088	2112	f2a0e4aadcdee7fd52580fc59adc1ea0N.exe	114
PID 2112 wrote to memory of 5088	2112	f2a0e4aadcdee7fd52580fc59adc1ea0N.exe	114
PID 2112 wrote to memory of 5088	2112	f2a0e4aadcdee7fd52580fc59adc1ea0N.exe	114
PID 4716 wrote to memory of 4724	4716	Unicorn-52985.exe	115

C:\Users\Admin\AppData\Local\Temp\f2a0e4aadcdee7fd52580fc59adc1ea0N.exe
"C:\Users\Admin\AppData\Local\Temp\f2a0e4aadcdee7fd52580fc59adc1ea0N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32845.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32845.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23691.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23691.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4998.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56830.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61018.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13353.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33917.exe
        8⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22215.exe
        9⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6558.exe
        10⤵
        
        PID:8688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27223.exe
        11⤵
        
        PID:13084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38649.exe
        11⤵
        
        PID:15568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32572.exe
        10⤵
        
        PID:12524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56547.exe
        10⤵
        
        PID:10464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9635.exe
        9⤵
        
        PID:8720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16842.exe
        9⤵
        
        PID:11484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39553.exe
        9⤵
        
        PID:8380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52209.exe
        8⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19382.exe
        9⤵
        
        PID:11028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14254.exe
        9⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12582.exe
        9⤵
        
        PID:11004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58840.exe
        8⤵
        
        PID:8500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46610.exe
        8⤵
        
        PID:13508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42071.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38555.exe
        7⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28349.exe
        8⤵
        
        PID:8248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3600.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27989.exe
        8⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55529.exe
        7⤵
        
        PID:7760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44752.exe
        7⤵
        
        PID:10420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39481.exe
        7⤵
        
        PID:14692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19806.exe
        7⤵
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8243.exe
        6⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65193.exe
        7⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17694.exe
        8⤵
        
        PID:9668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41923.exe
        8⤵
        
        PID:13480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-959.exe
        8⤵
        
        PID:17072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15857.exe
        7⤵
        
        PID:10224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34247.exe
        7⤵
        
        PID:12460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12749.exe
        7⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23020.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1612.exe
        6⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6558.exe
        7⤵
        
        PID:8784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32572.exe
        7⤵
        
        PID:12496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56547.exe
        7⤵
        
        PID:9204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33590.exe
        6⤵
        
        PID:8568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63044.exe
        6⤵
        
        PID:3868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23550.exe
        6⤵
        
        PID:3332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22023.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1978.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36247.exe
        7⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46693.exe
        8⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40741.exe
        9⤵
        
        PID:10992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27989.exe
        9⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44514.exe
        9⤵
        
        PID:10720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39271.exe
        8⤵
        
        PID:11136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64866.exe
        8⤵
        
        PID:15292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53747.exe
        8⤵
        
        PID:8684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58706.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12244.exe
        7⤵
        
        PID:10624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48146.exe
        7⤵
        
        PID:14708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3368.exe
        7⤵
        
        PID:10244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7419.exe
        6⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28349.exe
        7⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32986.exe
        7⤵
        
        PID:12468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50736.exe
        7⤵
        
        PID:9972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6074.exe
        6⤵
        
        PID:3572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6433.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53586.exe
        6⤵
        
        PID:4152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29427.exe
        6⤵
        
        PID:7852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19009.exe
        5⤵
        
        PID:2492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27093.exe
        6⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50559.exe
        7⤵
        
        PID:9548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1959.exe
        7⤵
        
        PID:13708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15349.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41923.exe
        6⤵
        
        PID:8516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40741.exe
        7⤵
        
        PID:11016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe
        7⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38484.exe
        7⤵
        
        PID:7148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15498.exe
        6⤵
        
        PID:11624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11296.exe
        6⤵
        
        PID:2804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40509.exe
        6⤵
        
        PID:16708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28743.exe
        5⤵
        
        PID:6544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50523.exe
        6⤵
        
        PID:800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21837.exe
        7⤵
        
        PID:8164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38171.exe
        6⤵
        
        PID:11364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23905.exe
        6⤵
        
        PID:1948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38484.exe
        6⤵
        
        PID:6460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30293.exe
        5⤵
        
        PID:9744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33047.exe
        5⤵
        
        PID:13216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15341.exe
        5⤵
        
        PID:7172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52091.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28154.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12284.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12956.exe
        7⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53621.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59402.exe
        9⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63154.exe
        9⤵
        
        PID:15700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58338.exe
        8⤵
        
        PID:12260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5400.exe
        8⤵
        
        PID:9348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55659.exe
        7⤵
        
        PID:8472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23035.exe
        8⤵
        
        PID:11040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40304.exe
        8⤵
        
        PID:15068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48379.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60258.exe
        7⤵
        
        PID:12012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21105.exe
        7⤵
        
        PID:232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58784.exe
        7⤵
        
        PID:17028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53906.exe
        6⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18811.exe
        7⤵
        
        PID:8656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32572.exe
        7⤵
        
        PID:12508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31388.exe
        7⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61343.exe
        7⤵
        
        PID:9052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18819.exe
        6⤵
        
        PID:7920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57772.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35194.exe
        6⤵
        
        PID:15664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14785.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31670.exe
        6⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20461.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4804.exe
        8⤵
        
        PID:8468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27995.exe
        8⤵
        
        PID:12848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48379.exe
        8⤵
        
        PID:9272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59796.exe
        7⤵
        
        PID:9516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63412.exe
        7⤵
        
        PID:13524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15349.exe
        7⤵
        
        PID:16416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26827.exe
        6⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14586.exe
        7⤵
        
        PID:12788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23683.exe
        7⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43309.exe
        7⤵
        
        PID:17084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48809.exe
        6⤵
        
        PID:11104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43678.exe
        6⤵
        
        PID:14228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36341.exe
        6⤵
        
        PID:16316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2104.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62474.exe
        6⤵
        
        PID:7400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6536.exe
        6⤵
        
        PID:12264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50736.exe
        6⤵
        
        PID:16388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24685.exe
        5⤵
        
        PID:7924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63403.exe
        6⤵
        
        PID:14164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44680.exe
        6⤵
        
        PID:15724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49107.exe
        5⤵
        
        PID:11276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10107.exe
        5⤵
        
        PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31418.exe
        5⤵
        
        PID:8396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27889.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34843.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3574.exe
        6⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33590.exe
        7⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6568 -s 636
        8⤵
        Program crash
        
        PID:10004
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5964 -s 636
        7⤵
        Program crash
        
        PID:9496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63008.exe
        6⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35531.exe
        7⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27995.exe
        7⤵
        
        PID:12876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39142.exe
        7⤵
        
        PID:7220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32498.exe
        6⤵
        
        PID:9580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47788.exe
        6⤵
        
        PID:13500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29818.exe
        6⤵
        
        PID:15364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55276.exe
        5⤵
        
        PID:6072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46693.exe
        6⤵
        
        PID:7308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19439.exe
        7⤵
        
        PID:14504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20829.exe
        7⤵
        
        PID:7160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24383.exe
        6⤵
        
        PID:10892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42582.exe
        6⤵
        
        PID:14176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62412.exe
        6⤵
        
        PID:9208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6904.exe
        5⤵
        
        PID:7908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-704.exe
        5⤵
        
        PID:10600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39481.exe
        5⤵
        
        PID:14732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55686.exe
        5⤵
        
        PID:16444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59161.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61088.exe
        5⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
        6⤵
        
        PID:8336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3600.exe
        6⤵
        
        PID:11356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44295.exe
        6⤵
        
        PID:6380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31950.exe
        5⤵
        
        PID:9048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31447.exe
        5⤵
        
        PID:13308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20382.exe
        5⤵
        
        PID:15604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17579.exe
      4⤵
      PID:1984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62474.exe
        5⤵
        
        PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52370.exe
        5⤵
        
        PID:11472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe
        5⤵
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38484.exe
        5⤵
        
        PID:948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16549.exe
      4⤵
      PID:8044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28106.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6830.exe
      4⤵
      PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13713.exe
      4⤵
      PID:8124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24027.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24027.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52985.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60743.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11132.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8008.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34109.exe
        8⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18811.exe
        9⤵
        
        PID:8796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32572.exe
        9⤵
        
        PID:12484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39142.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42177.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7876.exe
        9⤵
        
        PID:11160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21939.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:14464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7045.exe
        9⤵
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34610.exe
        8⤵
        
        PID:10932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33564.exe
        8⤵
        
        PID:15024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63207.exe
        8⤵
        
        PID:15548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-813.exe
        7⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49987.exe
        8⤵
        
        PID:10536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65276.exe
        8⤵
        
        PID:13548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35272.exe
        8⤵
        
        PID:8356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45654.exe
        7⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40860.exe
        7⤵
        
        PID:9976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-778.exe
        7⤵
        
        PID:12780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19806.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21967.exe
        6⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27368.exe
        7⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50523.exe
        8⤵
        
        PID:7904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38171.exe
        8⤵
        
        PID:11828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58716.exe
        8⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38484.exe
        8⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26656.exe
        7⤵
        
        PID:9768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39401.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15349.exe
        7⤵
        
        PID:8208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22389.exe
        6⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2282.exe
        7⤵
        
        PID:8864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15739.exe
        8⤵
        
        PID:14744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12085.exe
        8⤵
        
        PID:9940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2723.exe
        7⤵
        
        PID:12792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56054.exe
        7⤵
        
        PID:10264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31758.exe
        6⤵
        
        PID:9296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31447.exe
        6⤵
        
        PID:13272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19313.exe
        6⤵
        
        PID:10284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42413.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14614.exe
        6⤵
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51898.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39101.exe
        8⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29501.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20512.exe
        9⤵
        
        PID:13288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55478.exe
        9⤵
        
        PID:9036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28192.exe
        8⤵
        
        PID:10092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37254.exe
        9⤵
        
        PID:14092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36672.exe
        9⤵
        
        PID:10972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52421.exe
        8⤵
        
        PID:13340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62412.exe
        8⤵
        
        PID:10468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37071.exe
        7⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12017.exe
        7⤵
        
        PID:11000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6523.exe
        7⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54124.exe
        7⤵
        
        PID:16660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39406.exe
        6⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49987.exe
        7⤵
        
        PID:10544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65276.exe
        7⤵
        
        PID:12840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25189.exe
        7⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62868.exe
        7⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51383.exe
        6⤵
        
        PID:8996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47596.exe
        6⤵
        
        PID:12924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1946.exe
        6⤵
        
        PID:1720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64046.exe
        6⤵
        
        PID:7828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52039.exe
        5⤵
        
        PID:2236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42827.exe
        6⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14342.exe
        7⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5307.exe
        7⤵
        
        PID:11396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27989.exe
        7⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34523.exe
        6⤵
        
        PID:9900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63704.exe
        7⤵
        
        PID:12784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27051.exe
        7⤵
        
        PID:9148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34247.exe
        6⤵
        
        PID:12416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15349.exe
        6⤵
        
        PID:6116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36200.exe
        5⤵
        
        PID:7492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        5⤵
        
        PID:11220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33405.exe
        5⤵
        
        PID:14444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8818.exe
        5⤵
        
        PID:6196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49046.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23961.exe
        5⤵
        Executes dropped EXE
        
        PID:4092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2938.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32521.exe
        7⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62474.exe
        8⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4238.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe
        8⤵
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38484.exe
        8⤵
        
        PID:9740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61166.exe
        7⤵
        
        PID:9880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34247.exe
        7⤵
        
        PID:13144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62412.exe
        7⤵
        
        PID:6604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
        6⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31447.exe
        7⤵
        
        PID:9232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27995.exe
        7⤵
        
        PID:12868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17652.exe
        7⤵
        
        PID:6256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
        6⤵
        
        PID:10440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56611.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47356.exe
        6⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42601.exe
        6⤵
        
        PID:7440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1355.exe
        5⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33590.exe
        6⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62391.exe
        7⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6576 -s 664
        7⤵
        Program crash
        
        PID:9376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4975.exe
        6⤵
        
        PID:8736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46308.exe
        6⤵
        
        PID:12432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50736.exe
        6⤵
        
        PID:7472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11206.exe
        5⤵
        
        PID:6868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13221.exe
        6⤵
        
        PID:9508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28545.exe
        6⤵
        
        PID:14700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39142.exe
        6⤵
        
        PID:7888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16381.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48936.exe
        5⤵
        
        PID:13736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6485.exe
        5⤵
        
        PID:9156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60809.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59046.exe
        5⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37783.exe
        6⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18811.exe
        7⤵
        
        PID:8760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11270.exe
        8⤵
        
        PID:14312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41441.exe
        8⤵
        
        PID:17108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32572.exe
        7⤵
        
        PID:12516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56547.exe
        7⤵
        
        PID:10452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37647.exe
        6⤵
        
        PID:8976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41731.exe
        6⤵
        
        PID:12948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15925.exe
        6⤵
        
        PID:9948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33075.exe
        5⤵
        
        PID:6660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62474.exe
        6⤵
        
        PID:6424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5307.exe
        6⤵
        
        PID:11404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27989.exe
        6⤵
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49174.exe
        6⤵
        
        PID:16364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9364.exe
        5⤵
        
        PID:9868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5733.exe
        6⤵
        
        PID:13980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20829.exe
        6⤵
        
        PID:8972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40113.exe
        5⤵
        
        PID:12104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25734.exe
        5⤵
        
        PID:9848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52559.exe
      4⤵
      PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55271.exe
        5⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28349.exe
        6⤵
        
        PID:8236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51841.exe
        6⤵
        
        PID:11720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe
        6⤵
        
        PID:2348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29247.exe
        6⤵
        
        PID:9520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44446.exe
        5⤵
        
        PID:8804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-762.exe
        6⤵
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29573.exe
        6⤵
        
        PID:8840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16842.exe
        5⤵
        
        PID:12532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15349.exe
        5⤵
        
        PID:6848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58183.exe
      4⤵
      PID:7376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1846.exe
        5⤵
        
        PID:10988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6864.exe
        5⤵
        
        PID:14992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55478.exe
        5⤵
        
        PID:7980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29473.exe
      4⤵
      PID:11116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35543.exe
      4⤵
      PID:14360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3888.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20212.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20212.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6062.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3574.exe
        6⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44965.exe
        7⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29994.exe
        8⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5832 -s 636
        8⤵
        Program crash
        
        PID:11440
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5972 -s 652
        7⤵
        Program crash
        
        PID:9504
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 656
        6⤵
        Program crash
        
        PID:7228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10543.exe
        5⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44280.exe
        6⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62474.exe
        7⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41997.exe
        8⤵
        
        PID:12712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35027.exe
        8⤵
        
        PID:16744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48286.exe
        7⤵
        
        PID:11428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27989.exe
        7⤵
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38484.exe
        7⤵
        
        PID:15684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5363.exe
        6⤵
        
        PID:9956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32682.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53247.exe
        6⤵
        
        PID:2056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-407.exe
        5⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52059.exe
        6⤵
        
        PID:8460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8456.exe
        6⤵
        
        PID:14004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38484.exe
        6⤵
        
        PID:15796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15120.exe
        5⤵
        
        PID:10044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22101.exe
        5⤵
        
        PID:14316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25535.exe
        5⤵
        
        PID:9912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35703.exe
      4⤵
      PID:636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55271.exe
        5⤵
        
        PID:7040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52853.exe
        6⤵
        
        PID:7612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21259.exe
        6⤵
        
        PID:6484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3578.exe
        6⤵
        
        PID:14396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45007.exe
        6⤵
        
        PID:8040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34139.exe
        5⤵
        
        PID:7656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41731.exe
        5⤵
        
        PID:12940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10611.exe
        5⤵
        
        PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6684.exe
        5⤵
        
        PID:16424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45852.exe
      4⤵
      PID:2308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1846.exe
        5⤵
        
        PID:10012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
        5⤵
        
        PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39361.exe
        5⤵
        
        PID:16688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35510.exe
      4⤵
      PID:10760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40075.exe
      4⤵
      PID:12720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1023.exe
      4⤵
      PID:5328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9695.exe
      4⤵
      PID:16728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3109.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3109.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19109.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19275.exe
        5⤵
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44773.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49987.exe
        7⤵
        
        PID:10552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65276.exe
        7⤵
        
        PID:1112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57831.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10704.exe
        6⤵
        
        PID:8444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16842.exe
        6⤵
        
        PID:12388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62412.exe
        6⤵
        
        PID:9440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26059.exe
        5⤵
        
        PID:7076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31800.exe
        6⤵
        
        PID:13284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29189.exe
        6⤵
        
        PID:9188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54948.exe
        5⤵
        
        PID:10132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58286.exe
        5⤵
        
        PID:12756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23020.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54640.exe
      4⤵
      PID:5188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26216.exe
        5⤵
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18043.exe
        6⤵
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4472.exe
        7⤵
        
        PID:13496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19791.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6152.exe
        6⤵
        
        PID:11208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4581.exe
        6⤵
        
        PID:13112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23596.exe
        6⤵
        
        PID:16720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26084.exe
        5⤵
        
        PID:8344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22708.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36341.exe
        5⤵
        
        PID:15932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31543.exe
      4⤵
      PID:6556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53621.exe
        5⤵
        
        PID:8636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32572.exe
        5⤵
        
        PID:12704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56547.exe
        5⤵
        
        PID:9136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35458.exe
      4⤵
      PID:10180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54658.exe
      4⤵
      PID:13996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-914.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-914.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53925.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53925.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13929.exe
      4⤵
      PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17254.exe
        5⤵
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50523.exe
        6⤵
        
        PID:8020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26380.exe
        6⤵
        
        PID:11384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33554.exe
        6⤵
        
        PID:15716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35893.exe
        5⤵
        
        PID:9760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39401.exe
        5⤵
        
        PID:12684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45007.exe
        5⤵
        
        PID:7272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46672.exe
      4⤵
      PID:6536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55712.exe
        5⤵
        
        PID:9596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9250.exe
        5⤵
        
        PID:3432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61343.exe
        5⤵
        
        PID:17124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39516.exe
      4⤵
      PID:10412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56611.exe
      4⤵
      PID:12836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21451.exe
      4⤵
      PID:8128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14037.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14037.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28629.exe
      4⤵
      PID:7032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20181.exe
        5⤵
        
        PID:7392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40741.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13963.exe
        6⤵
        
        PID:15052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38649.exe
        6⤵
        
        PID:7552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50392.exe
        5⤵
        
        PID:12476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43938.exe
        5⤵
        
        PID:16380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5551.exe
      4⤵
      PID:8552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34247.exe
      4⤵
      PID:9856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15349.exe
      4⤵
      PID:16436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37717.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37717.exe
    3⤵
    PID:6972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23528.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28545.exe
      4⤵
      PID:14716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37611.exe
      4⤵
      PID:6224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43938.exe
      4⤵
      PID:8408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14510.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14510.exe
    3⤵
    PID:10748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30275.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30275.exe
    3⤵
    PID:12776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17143.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17143.exe
    3⤵
    PID:15676
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38635.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38635.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31641.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31641.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10006.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1428.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19301.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12092.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25941.exe
        8⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46693.exe
        9⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47752.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:14200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2547.exe
        10⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40724.exe
        9⤵
        
        PID:10588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25189.exe
        9⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62868.exe
        9⤵
        
        PID:8376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27979.exe
        8⤵
        
        PID:7948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-869.exe
        8⤵
        
        PID:10796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49023.exe
        8⤵
        
        PID:14940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35848.exe
        8⤵
        
        PID:10500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        7⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28842.exe
        8⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23557.exe
        8⤵
        
        PID:9700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20917.exe
        8⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23020.exe
        8⤵
        
        PID:9444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47491.exe
        7⤵
        
        PID:8412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23201.exe
        7⤵
        
        PID:11212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34810.exe
        7⤵
        
        PID:15400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51602.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64370.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20871.exe
        7⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46693.exe
        8⤵
        
        PID:7356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4664.exe
        9⤵
        
        PID:14252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27051.exe
        9⤵
        
        PID:10124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35073.exe
        8⤵
        
        PID:11144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37813.exe
        8⤵
        
        PID:14348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39392.exe
        8⤵
        
        PID:15424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46648.exe
        8⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34662.exe
        7⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10009.exe
        8⤵
        
        PID:14560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47472.exe
        8⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44991.exe
        7⤵
        
        PID:11556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20420.exe
        7⤵
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63361.exe
        7⤵
        
        PID:7444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21154.exe
        6⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41177.exe
        7⤵
        
        PID:8984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27995.exe
        7⤵
        
        PID:12884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38649.exe
        7⤵
        
        PID:10388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11939.exe
        6⤵
        
        PID:2788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42548.exe
        6⤵
        
        PID:11896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59801.exe
        6⤵
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41039.exe
        6⤵
        
        PID:17096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63903.exe
        5⤵
        Executes dropped EXE
        
        PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28520.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42277.exe
        6⤵
        
        PID:1140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46693.exe
        7⤵
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35073.exe
        7⤵
        
        PID:11172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51832.exe
        7⤵
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13283.exe
        7⤵
        
        PID:6348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34662.exe
        6⤵
        
        PID:7212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44991.exe
        6⤵
        
        PID:11564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21105.exe
        6⤵
        
        PID:1664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13283.exe
        6⤵
        
        PID:9424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20413.exe
        5⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28629.exe
        6⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12012.exe
        7⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63216.exe
        7⤵
        
        PID:11604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27989.exe
        7⤵
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38484.exe
        7⤵
        
        PID:7112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58836.exe
        6⤵
        
        PID:8432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34247.exe
        6⤵
        
        PID:13052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45007.exe
        6⤵
        
        PID:7120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37186.exe
        5⤵
        
        PID:6328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39395.exe
        5⤵
        
        PID:10844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33213.exe
        5⤵
        
        PID:13912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4734.exe
        5⤵
        
        PID:6212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51184.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35637.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53509.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20871.exe
        7⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56506.exe
        8⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25151.exe
        8⤵
        
        PID:10352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42281.exe
        8⤵
        
        PID:14680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22449.exe
        8⤵
        
        PID:8388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46610.exe
        7⤵
        
        PID:7364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45593.exe
        8⤵
        
        PID:10976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe
        8⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38484.exe
        8⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34994.exe
        7⤵
        
        PID:9568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57753.exe
        7⤵
        
        PID:15628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51166.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54607.exe
        7⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26380.exe
        7⤵
        
        PID:11272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37939.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52185.exe
        7⤵
        
        PID:16496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41461.exe
        6⤵
        
        PID:9680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41182.exe
        6⤵
        
        PID:13200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35848.exe
        6⤵
        
        PID:10516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34219.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28437.exe
        6⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17694.exe
        7⤵
        
        PID:9648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41923.exe
        7⤵
        
        PID:13472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45007.exe
        7⤵
        
        PID:8160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15857.exe
        6⤵
        
        PID:10208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34247.exe
        6⤵
        
        PID:12340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45007.exe
        6⤵
        
        PID:7628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44948.exe
        5⤵
        
        PID:7000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2391.exe
        6⤵
        
        PID:7868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26380.exe
        6⤵
        
        PID:11692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24810.exe
        6⤵
        
        PID:15556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51410.exe
        5⤵
        
        PID:9724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30648.exe
        6⤵
        
        PID:13516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24913.exe
        6⤵
        
        PID:10488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32516.exe
        5⤵
        
        PID:13168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9199.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28437.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8392.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20871.exe
        6⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46693.exe
        7⤵
        
        PID:7432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1846.exe
        8⤵
        
        PID:10916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6864.exe
        8⤵
        
        PID:14984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39142.exe
        8⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35073.exe
        7⤵
        
        PID:11196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35675.exe
        7⤵
        
        PID:14476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55728.exe
        7⤵
        
        PID:15384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51801.exe
        7⤵
        
        PID:8068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49469.exe
        6⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41997.exe
        7⤵
        
        PID:14100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26506.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48763.exe
        7⤵
        
        PID:11064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-869.exe
        6⤵
        
        PID:10888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49023.exe
        6⤵
        
        PID:14916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40125.exe
        6⤵
        
        PID:8896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17917.exe
        5⤵
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-938.exe
        6⤵
        
        PID:7284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6152.exe
        6⤵
        
        PID:11632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7212.exe
        6⤵
        
        PID:1260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29818.exe
        6⤵
        
        PID:15708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26605.exe
        5⤵
        
        PID:9364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14042.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62785.exe
        5⤵
        
        PID:16332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13856.exe
      4⤵
      PID:5124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32521.exe
        5⤵
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6558.exe
        6⤵
        
        PID:8540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4669.exe
        6⤵
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5431.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6880.exe
        6⤵
        
        PID:8216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15857.exe
        5⤵
        
        PID:10216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16842.exe
        5⤵
        
        PID:12364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6527.exe
        5⤵
        
        PID:15368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51993.exe
        5⤵
        
        PID:15828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46232.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40762.exe
        5⤵
        
        PID:13932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19952.exe
        5⤵
        
        PID:16292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12670.exe
      4⤵
      PID:9892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32061.exe
      4⤵
      PID:13756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14848.exe
      4⤵
      PID:7824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33119.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33119.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21849.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45751.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14998.exe
        6⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42827.exe
        7⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17694.exe
        8⤵
        
        PID:9656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41923.exe
        8⤵
        
        PID:13488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31608.exe
        8⤵
        
        PID:15608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15857.exe
        7⤵
        
        PID:10200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34247.exe
        7⤵
        
        PID:12544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34400.exe
        7⤵
        
        PID:9672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24113.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13849.exe
        7⤵
        
        PID:9524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41997.exe
        8⤵
        
        PID:13844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14254.exe
        8⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32618.exe
        8⤵
        
        PID:9708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21581.exe
        7⤵
        
        PID:12692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39142.exe
        7⤵
        
        PID:7228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57003.exe
        6⤵
        
        PID:9752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12977.exe
        6⤵
        
        PID:13592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35848.exe
        6⤵
        
        PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41684.exe
        5⤵
        
        PID:5356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46693.exe
        6⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1846.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6864.exe
        7⤵
        
        PID:14976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1015.exe
        7⤵
        
        PID:7812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39271.exe
        6⤵
        
        PID:11152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64866.exe
        6⤵
        
        PID:15284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35848.exe
        6⤵
        
        PID:8084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3532.exe
        5⤵
        
        PID:7968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19558.exe
        5⤵
        
        PID:10836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1264.exe
        5⤵
        
        PID:14960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4614.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2020.exe
        5⤵
        
        PID:9560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18982.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12956.exe
        5⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19413.exe
        6⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31565.exe
        6⤵
        
        PID:9756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43476.exe
        6⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23596.exe
        6⤵
        
        PID:11416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55659.exe
        5⤵
        
        PID:8504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49288.exe
        6⤵
        
        PID:15100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23683.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39142.exe
        6⤵
        
        PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19116.exe
        5⤵
        
        PID:11452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25189.exe
        5⤵
        
        PID:5668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27020.exe
      4⤵
      PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63735.exe
        5⤵
        
        PID:8832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32572.exe
        5⤵
        
        PID:12424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17652.exe
        5⤵
        
        PID:9152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3274.exe
      4⤵
      PID:3328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26012.exe
      4⤵
      PID:11508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1023.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10764.exe
      4⤵
      PID:7556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19802.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19802.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29415.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19083.exe
        5⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61301.exe
        6⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49987.exe
        7⤵
        
        PID:10560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65276.exe
        7⤵
        
        PID:820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36341.exe
        7⤵
        
        PID:7180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42499.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16842.exe
        6⤵
        
        PID:12400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45007.exe
        6⤵
        
        PID:16668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11861.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28349.exe
        6⤵
        
        PID:8196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35504.exe
        6⤵
        
        PID:11700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23905.exe
        6⤵
        
        PID:3276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11841.exe
        6⤵
        
        PID:8096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58181.exe
        5⤵
        
        PID:8812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22708.exe
        5⤵
        
        PID:4692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45963.exe
        5⤵
        
        PID:16652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19637.exe
      4⤵
      PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27560.exe
        5⤵
        
        PID:7100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53621.exe
        6⤵
        
        PID:8600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59215.exe
        6⤵
        
        PID:12372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17652.exe
        6⤵
        
        PID:8872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60481.exe
        5⤵
        
        PID:9288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16842.exe
        5⤵
        
        PID:9196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45007.exe
        5⤵
        
        PID:9252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60983.exe
      4⤵
      PID:7384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13740.exe
        5⤵
        
        PID:8776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8456.exe
        5⤵
        
        PID:14012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45007.exe
        5⤵
        
        PID:6340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64705.exe
      4⤵
      PID:4836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37944.exe
      4⤵
      PID:3344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15229.exe
      4⤵
      PID:7188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6591.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6591.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53016.exe
      4⤵
      PID:5144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8234.exe
        5⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14103.exe
        6⤵
        
        PID:7856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52059.exe
        7⤵
        
        PID:8904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3107.exe
        7⤵
        
        PID:12732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4440.exe
        7⤵
        
        PID:6292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2811.exe
        6⤵
        
        PID:10024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41430.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23518.exe
        6⤵
        
        PID:8716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5084.exe
        5⤵
        
        PID:7944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51001.exe
        6⤵
        
        PID:10480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51907.exe
        5⤵
        
        PID:11312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39392.exe
        5⤵
        
        PID:1580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37602.exe
        5⤵
        
        PID:15864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17533.exe
      4⤵
      PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4420.exe
        5⤵
        
        PID:8616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50549.exe
        6⤵
        
        PID:14612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59215.exe
        5⤵
        
        PID:12380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17652.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39323.exe
      4⤵
      PID:8312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46828.exe
      4⤵
      PID:11436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8661.exe
      4⤵
      PID:5424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53247.exe
      4⤵
      PID:4636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55269.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55269.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55271.exe
      4⤵
      PID:6992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44529.exe
        5⤵
        
        PID:9488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16842.exe
        5⤵
        
        PID:11492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23518.exe
        5⤵
        
        PID:8156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43075.exe
      4⤵
      PID:8320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34247.exe
      4⤵
      PID:12440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44514.exe
      4⤵
      PID:10648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20651.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20651.exe
    3⤵
    PID:6388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22631.exe
      4⤵
      PID:7512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57530.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57530.exe
    3⤵
    PID:10772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35610.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35610.exe
    3⤵
    PID:884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37063.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37063.exe
    3⤵
    PID:4488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14206.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14206.exe
    3⤵
    PID:16712
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64405.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64405.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56830.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56830.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39529.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34843.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1628.exe
        6⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52941.exe
        7⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62858.exe
        8⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25970.exe
        8⤵
        
        PID:14056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45583.exe
        8⤵
        
        PID:15512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10704.exe
        7⤵
        
        PID:9132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34247.exe
        7⤵
        
        PID:12540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23518.exe
        7⤵
        
        PID:9164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26059.exe
        6⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4612.exe
        7⤵
        
        PID:9600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21581.exe
        7⤵
        
        PID:13232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26396.exe
        7⤵
        
        PID:15660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8679.exe
        6⤵
        
        PID:8256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22708.exe
        6⤵
        
        PID:12320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14359.exe
        6⤵
        
        PID:16400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26691.exe
        5⤵
        
        PID:5196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54607.exe
        6⤵
        
        PID:7892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1732.exe
        7⤵
        
        PID:15236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45526.exe
        7⤵
        
        PID:9432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26380.exe
        6⤵
        
        PID:11288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39392.exe
        6⤵
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13783.exe
        6⤵
        
        PID:6272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61524.exe
        5⤵
        
        PID:8424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59652.exe
        5⤵
        
        PID:10740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24990.exe
        5⤵
        
        PID:1164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42601.exe
        5⤵
        
        PID:10812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51734.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41400.exe
        5⤵
        
        PID:5996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23689.exe
        6⤵
        
        PID:1856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62484.exe
        6⤵
        
        PID:11128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-755.exe
        6⤵
        
        PID:15116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15349.exe
        6⤵
        
        PID:16408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15727.exe
        5⤵
        
        PID:7872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13159.exe
        6⤵
        
        PID:12008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60376.exe
        5⤵
        
        PID:10592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48146.exe
        5⤵
        
        PID:14724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6684.exe
        5⤵
        
        PID:9388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14740.exe
      4⤵
      PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28842.exe
        5⤵
        
        PID:6988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1846.exe
        6⤵
        
        PID:10020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27989.exe
        6⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38484.exe
        6⤵
        
        PID:7164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62484.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36443.exe
        5⤵
        
        PID:15344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45007.exe
        5⤵
        
        PID:15920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18078.exe
      4⤵
      PID:7396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1846.exe
        5⤵
        
        PID:10852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50912.exe
        5⤵
        
        PID:14932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42925.exe
        5⤵
        
        PID:8792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32194.exe
      4⤵
      PID:8732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49779.exe
      4⤵
      PID:14484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26265.exe
      4⤵
      PID:9808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6756.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6756.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4116.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24187.exe
        5⤵
        
        PID:5900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27752.exe
        6⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50523.exe
        7⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26380.exe
        7⤵
        
        PID:10008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62412.exe
        7⤵
        
        PID:17036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35893.exe
        6⤵
        
        PID:9776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39401.exe
        6⤵
        
        PID:12492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10611.exe
        6⤵
        
        PID:4948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36341.exe
        6⤵
        
        PID:7756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57170.exe
        5⤵
        
        PID:6456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19387.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20512.exe
        6⤵
        
        PID:4564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30890.exe
        6⤵
        
        PID:6680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4102.exe
        5⤵
        
        PID:8448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53325.exe
        5⤵
        
        PID:14068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36341.exe
        5⤵
        
        PID:10460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11804.exe
      4⤵
      PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46693.exe
        5⤵
        
        PID:7300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36464.exe
        6⤵
        
        PID:9636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17159.exe
        6⤵
        
        PID:6180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45873.exe
        5⤵
        
        PID:10908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42582.exe
        5⤵
        
        PID:14184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6112.exe
        5⤵
        
        PID:16272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63204.exe
      4⤵
      PID:7956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32143.exe
        5⤵
        
        PID:8120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6734.exe
      4⤵
      PID:10788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40358.exe
      4⤵
      PID:14888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19806.exe
      4⤵
      PID:7456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53436.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53436.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12956.exe
      4⤵
      PID:540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45754.exe
        5⤵
        
        PID:8292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15852.exe
        5⤵
        
        PID:11324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27989.exe
        5⤵
        
        PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18447.exe
        5⤵
        
        PID:17048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31950.exe
      4⤵
      PID:9060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54658.exe
      4⤵
      PID:11708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37448.exe
      4⤵
      PID:16700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18354.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18354.exe
    3⤵
    PID:5324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50523.exe
      4⤵
      PID:8092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38171.exe
      4⤵
      PID:11372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe
      4⤵
      PID:2800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38484.exe
      4⤵
      PID:6044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52276.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52276.exe
    3⤵
    PID:4664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43078.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43078.exe
    3⤵
    PID:11500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5642.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5642.exe
    3⤵
    PID:6016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43446.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43446.exe
    3⤵
    PID:6960
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52720.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52720.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48491.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48491.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6856.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26374.exe
        5⤵
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44773.exe
        6⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36517.exe
        7⤵
        
        PID:8300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63403.exe
        8⤵
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55095.exe
        8⤵
        
        PID:13120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33495.exe
        8⤵
        
        PID:16680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42494.exe
        7⤵
        
        PID:11696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40242.exe
        7⤵
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39361.exe
        7⤵
        
        PID:16516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15857.exe
        6⤵
        
        PID:10192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34247.exe
        6⤵
        
        PID:13152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50736.exe
        6⤵
        
        PID:9788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56786.exe
        5⤵
        
        PID:7140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34135.exe
        6⤵
        
        PID:10824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21747.exe
        6⤵
        
        PID:13768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39142.exe
        6⤵
        
        PID:7692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53495.exe
        5⤵
        
        PID:9980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32682.exe
        5⤵
        
        PID:14088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25535.exe
        5⤵
        
        PID:7248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44334.exe
      4⤵
      PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32521.exe
        5⤵
        
        PID:6732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62474.exe
        6⤵
        
        PID:6532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6536.exe
        6⤵
        
        PID:6400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58250.exe
        6⤵
        
        PID:15580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5363.exe
        5⤵
        
        PID:9964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40196.exe
        5⤵
        
        PID:13776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2600.exe
        5⤵
        
        PID:10928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44948.exe
      4⤵
      PID:6828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45261.exe
        5⤵
        
        PID:9140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27995.exe
        5⤵
        
        PID:12896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5400.exe
        5⤵
        
        PID:9256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31758.exe
      4⤵
      PID:9316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31447.exe
      4⤵
      PID:13264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29043.exe
      4⤵
      PID:9068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4095.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4095.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53016.exe
      4⤵
      PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51981.exe
        5⤵
        
        PID:2608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45754.exe
        6⤵
        
        PID:8284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48717.exe
        6⤵
        
        PID:10312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62800.exe
        6⤵
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64934.exe
        6⤵
        
        PID:16476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53216.exe
        5⤵
        
        PID:7988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41483.exe
        5⤵
        
        PID:11548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36341.exe
        5⤵
        
        PID:7816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12956.exe
      4⤵
      PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53621.exe
        5⤵
        
        PID:8572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-315.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25189.exe
        5⤵
        
        PID:6084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55659.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25578.exe
        5⤵
        
        PID:13540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37357.exe
        5⤵
        
        PID:9004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5795.exe
      4⤵
      PID:11340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53586.exe
      4⤵
      PID:15416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53247.exe
      4⤵
      PID:6200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19174.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19174.exe
    3⤵
    PID:5228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42827.exe
      4⤵
      PID:6588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2391.exe
        5⤵
        
        PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36573.exe
        5⤵
        
        PID:11640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27989.exe
        5⤵
        
        PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22532.exe
        5⤵
        
        PID:8816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31809.exe
      4⤵
      PID:9712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35317.exe
      4⤵
      PID:13192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45007.exe
      4⤵
      PID:4108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43714.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43714.exe
    3⤵
    PID:6704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65167.exe
      4⤵
      PID:9116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41731.exe
      4⤵
      PID:12932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15349.exe
      4⤵
      PID:16504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15910.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15910.exe
    3⤵
    PID:8744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26972.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26972.exe
    3⤵
    PID:12448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36872.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36872.exe
    3⤵
    PID:7684
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17002.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17002.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49835.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49835.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20849.exe
      4⤵
      PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13657.exe
        5⤵
        
        PID:9468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27995.exe
        5⤵
        
        PID:12856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37419.exe
        5⤵
        
        PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45007.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27672.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8187.exe
      4⤵
      PID:11256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16822.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16822.exe
      4⤵
      PID:6048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30349.exe
      4⤵
      PID:7132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41684.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41684.exe
    3⤵
    PID:5340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46693.exe
      4⤵
      PID:7412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5733.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56548.exe
        5⤵
        
        PID:3716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42541.exe
        5⤵
        
        PID:7580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40724.exe
      4⤵
      PID:10872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-782.exe
      4⤵
      PID:15016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39279.exe
      4⤵
      PID:15688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47580.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47580.exe
    3⤵
    PID:7928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63606.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63606.exe
    3⤵
    PID:10804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23822.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23822.exe
    3⤵
    PID:14904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36872.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36872.exe
    3⤵
    PID:7696
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41473.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41473.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50262.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50262.exe
  2⤵
  - Executes dropped EXE
  PID:264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20871.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20871.exe
    3⤵
    PID:5580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18536.exe
      4⤵
      PID:7064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16616.exe
        5⤵
        
        PID:14836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31135.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54124.exe
      4⤵
      PID:6572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3578.exe
      4⤵
      PID:14416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45007.exe
      4⤵
      PID:7616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46610.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46610.exe
    3⤵
    PID:7348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-184.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-184.exe
    3⤵
    PID:10148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9443.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9443.exe
    3⤵
    PID:14496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42071.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42071.exe
    3⤵
    PID:8700
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6399.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6399.exe
  2⤵
  PID:5552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53621.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53621.exe
    3⤵
    PID:8580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6600.exe
      4⤵
      PID:15488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52817.exe
      4⤵
      PID:6352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11083.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11083.exe
    3⤵
    PID:12404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7045.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7045.exe
    3⤵
    PID:9836
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26523.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26523.exe
  2⤵
  PID:8488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31416.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31416.exe
    3⤵
    PID:13960
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47137.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47137.exe
  2⤵
  PID:11956
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29449.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29449.exe
  2⤵
  PID:8392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 228 -ip 228
1⤵
PID:6532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5972 -ip 5972
1⤵
PID:8924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5964 -ip 5964
1⤵
PID:9204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 6568 -ip 6568
1⤵
PID:9968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 6576 -ip 6576
1⤵
PID:9976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5832 -ip 5832
1⤵
PID:12264

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10006.exe

Filesize
468KB

MD5
b0cad8e437ceed731e46172e6102a9d7

SHA1
914fb1e35b2f3a048d918eacd7b3456436460a17

SHA256
7367e8ae36945b4069538f865c61dcdad16dd56b96945ef3cc789f4bd468e7c9

SHA512
90d2b85e0b0fd37b800ce4d77985e551e4f6e0720c6843b28405e8481cc96064daa8008d100164745147f0c9b9e91d97ecbac48bf5ae3d9c8a27e1299b9a21f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1428.exe

Filesize
468KB

MD5
5d78fa08f4f242411d21d97f11f68af1

SHA1
7128f35a964518ec4e984ed252c946eb79eee25b

SHA256
f7c29dee81fe96e0ca9a74d597afbaac37fbbec6c734ecb293cf0e0dbe63fe7a

SHA512
1a550e8c1e5d3e117419c06bea809f5433e6a966f93250c6db892e2fb5e206b6c6c6f5179e68cf193c99c46483fe5b74e62ae23aa8512811647c71031f65661f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17002.exe

Filesize
468KB

MD5
d2020db2d954805dfef76c9702a83a13

SHA1
80a2ff826279a20fbe91338373141040d173a5f8

SHA256
a1becf58fe00d85e96fee02e1c7929014e9f29079c3f5da4a306a8811f52329b

SHA512
184a6059ebaae776169be06edfee96bb77d91ec9f20ca38278724199c7017ee34d628d868daad718d298bfd506668b81a72a05d5c7650b99ac0ea7ecf17a7d07

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19802.exe

Filesize
468KB

MD5
bb480441deb0fd7347770e45bda7a6f8

SHA1
f56a884f64510a19565dc8d97c9f7f7ddf6d3b58

SHA256
b5ebef0af5605ab5fae4c42f5022a26c87219d753b874ca05f6d43f14acef893

SHA512
52bc0fea4637a30b2be37790f34308179491f3b1575e70f500e998513fe82292f3cc06c47d0704567272bd17223015f2f4d20203927cbb5508296d02a7acc4fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20212.exe

Filesize
468KB

MD5
f154b3ee4c2de0a95466e335c4b56549

SHA1
37e941e2d840765cc63518f349f4c36eccc4896a

SHA256
0fb635ea42b9e30b6a123e4d93d40782d8dca77443a9970484f857d5168ceb70

SHA512
c34854fb740f3f0b0a1001a10dafa5fbb5336e63d20c89432ccb1fab78ca57569645e6b036ea008b6966021405d6c0496c39bbd34a1d1a4ea4ba6f65a3b9ecdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21849.exe

Filesize
468KB

MD5
336c653d3df3f825f6c205c56a86db59

SHA1
b1910b29cdf6358e7cae80ab7fdb123d3da66ff0

SHA256
f4f393de320de2e00ca3616334b723ff989d9788cf91959858558cad8ac4d02c

SHA512
352efe9ef4901a848b8ba1ce366c16a08ec6c12be6de3cbd826c08411d5a51a247dff30faeedc9f404e0a0acf1fda7a1954ef5fd89feebf17c135d8e8166e718

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22023.exe

Filesize
468KB

MD5
35520779398f85c5983048157b598a73

SHA1
de91abbfa0201c92d2c1c64a60ed542fd5a66317

SHA256
12d9ca3a87c704d316b8f739b84dc28610a0c28f01221428dd9e8d6bba1c6991

SHA512
9619689e78d245cfd8a849ce170d2818fb12f5af5042d481ab9b99e931b952674327c0bb8c13dc9ff43debacea654015d48a74843ecbce9debf260772532cbb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23691.exe

Filesize
468KB

MD5
9f107eda25e05fa19577edb088ab51a0

SHA1
47cf850adeca717ff13321917743e9625432f0a9

SHA256
85be1eceb514e2dcd05b26bd0d7dc359e729475ed05a8cd891e9b3ad46b7e277

SHA512
c02b6ca6319b42a6c813a55129db81e5906400427db42711f8bcaaeb7fb1ed1a69fe555a0f94301b6aca5208ee6f4f117d07153891cf49b48dfb72366887a2a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24027.exe

Filesize
468KB

MD5
f30cb95fb76c026466f3c55a84734ff8

SHA1
2e81cb89d4ee12fe4af09e01996b569639b19db6

SHA256
71ffdde86a15196722b63a193bf5484ae23f066e09be6bbbf7d63aab4340b67e

SHA512
7158c89b9dcdae69531724d5121ee82fed72a7bb14e15a2c4d7c933634162fe21923b8767eda26aeee85aa3771729a8f56a517dcb5f2aa2e83040608a439b63b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27889.exe

Filesize
468KB

MD5
d8faf85eef5462d1a3de0b8986f82f32

SHA1
f172555e5dee0c1e68b9d3aeeaaaa77c037e47d7

SHA256
23b8551c7dd0332317c189212b18aeca252dc0fdc97fdb35159fe9b28bbd229c

SHA512
e9e298d52858b3fcca14d34a0ad11d677d1ed22f1af9b586fb83dc789f98083111c20bf0c9f4afeb97b1c8bbaaa6a5928214f36478dad9de69ce9172df251449

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28154.exe

Filesize
468KB

MD5
01266f9f406c4dc51b8ff6e347a542ad

SHA1
2c8b8aa794e705eef22417d7a994fa093e141c70

SHA256
6cbbeecbf32aaa791aeb943205588b63101d4d98a1739ca6f66b12b788bd3030

SHA512
b06f8e3906a4415d487fe9044241692b75ef8db1d61995011fde819cee42241e4e2d219c898313a4cb7f8d1fa156ceed96acb492ec489096174139d82c17b58c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3109.exe

Filesize
468KB

MD5
78447eb362d1bf79cfb8a1dea76124e4

SHA1
943385b294cb1732f2e9fe660d983c91803c51dc

SHA256
4c1eba9c9316a80dad8809ed54feaa0eeb55f4e4d2b91a8be093ce5fd4bbd1e8

SHA512
e1e669d255b98f38d02acf83cd6157a8e04522eeb4e6c9ffd509a035bd04f209303c76d2a5a728a6a300e9a568f05f8ba390ecc8b2cdecd68ce23650eaa206aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31641.exe

Filesize
468KB

MD5
67000ad32ecf17e54e4174e1d436fc4a

SHA1
1d2af257f6b63f316593c4dd129c0181f203da62

SHA256
060ad921c91af6fa80cd70118dc102d817043e1639f638d07133cc5e4e84ed0a

SHA512
eeba514a42b440023ba8419876ad9e972e6d3c457dcb10e548b90c6ae0da904726cd750410835d513cbcf999603aa86800d4e2017cfa06bb4fa9ecca92bb95a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32845.exe

Filesize
468KB

MD5
d162200e2c7035040d0662bd8524c325

SHA1
f990cb0a52b6295d56ada266ca20c9dd41635438

SHA256
14cac997da26b33991c239475841655a4d7f2729fb5397b1abce692226d23e42

SHA512
6494c6dc93d5317cd1b489b1f5fac4ddd1f3aefd2d8ed4d62d29708c7811731a9bcd6f1cfe57eef4a2453d5389f9ddc0203a9534404f2817ebd594ab5ec56aa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33119.exe

Filesize
468KB

MD5
04da513cec5f3425e266732af77305ef

SHA1
b07c853f7bf3cb0ad33e65d2ff40dd4a18c3f5f5

SHA256
89de53f5aec68cee78ff9433f16c351ab9d994cac99f6e6f6cfe53563d9d8187

SHA512
b8564d528b12271b406957e1a9d027dc042c2f728c861f48cb065ebd0dc464bded29a2f99f38206717e19f65002c93bfcd1ae5ab54cc724cedc7cbf3ffd9712b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37611.exe

Filesize
468KB

MD5
31623ecd56eba56ed3ca6470ca3b8613

SHA1
702b30de9a1dabbbeb2725dde266a47362efe1f8

SHA256
d2ed8681808d25cb496b71c2259fb7829f3bed0ed17f75b7a755cc49f336d872

SHA512
a1a62d70ddfe0a7a27baf0794e66cf1fb5257508ef868acbb21850bc0956350de3c862aef055b676f8b0702ff073a858a7c76f15a1e28f6f5e66457242cb4913

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38635.exe

Filesize
468KB

MD5
b5a016602b8ce345c578508d8e98611f

SHA1
4b97db0e7036ef6b49d7e565661c98a244d68e9a

SHA256
e96064c910db6aa510785ad253dd9219e81c705f10aa7f04909688b67c929f50

SHA512
d9b7cc08946c6d07aa0161c0f4f498162eed713b3d00a3f371534a952b9a2225c8dc061bdf85e3fda051a6d8f8f209bace4345dd39ffcc2d7b54439ae6428d47

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39529.exe

Filesize
468KB

MD5
f85f477bc4fb76b3ea4b4b9fd927f026

SHA1
601a87f94a018c718044d88028220d63a7266632

SHA256
64c7752eed67c3e6137fcf28ccc642d244da45b7cc97d89277d1f6b42e52b2a4

SHA512
3e9b1ce63690a980e63474329d97d0098811cab01643fc84a744d3fe3694e86dd3c54dfb29bfde3289b1d0b67f998ff102c63646d9e55491eea2d2126bc13828

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48491.exe

Filesize
468KB

MD5
18788d2d2804f0276367e907d5a08b96

SHA1
17f1bf294e5e1e5e2b4da01e0381fa28290fd799

SHA256
9711f72eccc25add92627fcc09ee0a2bc45984dea564ca91cfb04e75b292dfd9

SHA512
29f163546358b8b72b0f0baed4515cfadb7e89963fbea106963ddfe359cdf3ee5a77569e6a68d8793c248ebb18f601ddc4c7734bdff70e65061806ce7ee82246

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49046.exe

Filesize
468KB

MD5
4f8e6c3d0cfdc2780fd44b22a40943db

SHA1
25699655f3b8301d2e1b57c4c6066ab49de445da

SHA256
3b1c23684f021ac1708190147c9c4934ed87fbff43655321e141c1119d845744

SHA512
791c2cfc3181faae979bfd1f8ef72e7d081606b20cf680cdac88b43fb405d7f8acb5d36b391b207b7c6a35d349058933518aa338e420ddea1e6831ed43f42e7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4998.exe

Filesize
468KB

MD5
499863cefc795c7a6cb59f0396bb7393

SHA1
c4152992ced27e3dca6cfdea81ef62ab93806929

SHA256
9b36ae9308046a0e1cd5647e17312eaa2546e6dc48a1d0271e29a94170079df6

SHA512
cc1b7b64803e32d7de625eeedbbade496d9840a0dee6723f674e0976732da2429a47ab04cbd2df2aac0afb81866fa28531420f10df170c163ac23ef28112e10b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51184.exe

Filesize
468KB

MD5
88ad0918ad52673d9cf734a67b674cf5

SHA1
9298791bc9bd70ea55fa5f904e984976f2194127

SHA256
9c9593d3434a3da139baf3b9c7567ce3b3ca008861b426e3f96c8e70a8c626ce

SHA512
dabea4b12a19704f583f260f4a5327512a104cde4c50031ca0a15ad42e8ccd5e3d5e47088814a64ce3dba7c62ce56678480d046a62d19d2fcd8482ef64444792

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52091.exe

Filesize
468KB

MD5
bd718a14046397dc6d9b3778517d0659

SHA1
c0b9cb8c82542549dc94abccb5edb2a08d2dd75b

SHA256
90cc330f698182b066d93d40a56d06a60b15bdea2a661d47b7c97e97534b23a7

SHA512
1077b7febe2202adc10fa4f2cfb857ba2153572f84d0888256ca10c36354f21032d4327d9913a39ec64570f1d28fd8ddb8d9e4d35f46082ba09082ae7cdd69f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52720.exe

Filesize
468KB

MD5
e43945d378e11e08b9efa4ae1a583a01

SHA1
2fa9409481a2fa79d41b4267b137bb99e66b7841

SHA256
f1a68293aeaa93151a3f4c11ddf90d4b8a8bd0b943f574d8a2ceba925d139b95

SHA512
f7431bbf7301143ab43316a4a7842f08faa072636e8d1e80b3cfab7c77bb577bbe25fec53cf267c987d67e40392f86ce2c0902af7e73e73cd6f6e0705fe687d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52985.exe

Filesize
468KB

MD5
59eb6469f1c97f6a0ff57e8fce05f117

SHA1
b865bbd429a7d432a37d02a0f99239777c71ca6b

SHA256
f83070f7b68b8673691d165219229f7b63903f21fc267d424ab2ab7f0ecca5ae

SHA512
8f024eb7ce2a7159537cd722b5d228746f12c80c5e94eb31a52b1b5fc976b7a0d8a34a40f605db64cb7004ea2e44750b710e9d1a434b08478fcfcfc8a869e2f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56830.exe

Filesize
468KB

MD5
dc672d38433db2419c86d351b4dd70d7

SHA1
cbe53ad582bf3b308929bd7590afe40e19c305d6

SHA256
a7b6a69c07a72ad3dc510c8bdf58801b09206f3428107333220a08430a2f6b7e

SHA512
33a27cc28255ca78845b02567fb30e103eebb86130a7a1bbbf578a0aa7f4307c888883e617b04312019d6ce77a86e74257d8a26d94142cfa4136de6c767dbad1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60743.exe

Filesize
468KB

MD5
1e004c2644dba3a8a510b6c03802c828

SHA1
6e02e2ccb24250e7b27a23aa4360216817ef9c02

SHA256
551adb886838ad1cd975f6b681b2232ad3406f84a3782ed5aab361c4b8868012

SHA512
a1a9275c3c5b79a682d6de8e64109b3364484c0c5cb5233c397dc99ae9c5a992cf3009c99e55895844f655e760af4f27a60abfaacb18c70480496b8cc32bd2d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61018.exe

Filesize
468KB

MD5
b311a34a6c976638e552be2623437c23

SHA1
d988f5d4fdcbc1e5a301b3adac6dd4182fa736df

SHA256
f0a075eca9a6096b0bfe2f658958cefe1bbf3dfde18b0bf3dca5615319f7e955

SHA512
e87e3464d145e429795b4f938667f9de07f51d138401fc14fc9a353b43535f29b33ddbd138b8c6d8c37c6cf4e8282aaf7b0e8b16f49d89eca55dfe181da64573

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62450.exe

Filesize
468KB

MD5
0ef52033fdb8993a50d007832b6b803a

SHA1
7baf71d548da95da3ee253598c527d6a044b6e05

SHA256
e8018d3e5da99d525752a79f9b01bd6c1947195bf452a96d9512e324d5621bef

SHA512
f4ed1c44d8a3f82c4a6edba65b18b6997841b5738f92c985c1d81d2529c7f2e5a6c5c4361bf0c96e503289b86b757e674f89e6d510cb8d73af77e1fb911be0d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64405.exe

Filesize
468KB

MD5
f285e97282560d6fe446e0ddcfd175a3

SHA1
e9b1f34e4ffe6107bf8e8559139ad6ccb2385611

SHA256
2f9f6a2e2c804759828ac882e2e75ca58c3b23373b2374b9cfae5a3ba8305547

SHA512
b0f0749fb28d4f60ab0d23f9aee4d448ce291dbe855cb0f8d622904912dbc05bdaffafc4d7a854cf963176d3fdaae5c4f17e2ffc5159067129859ac729512b62

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6756.exe

Filesize
468KB

MD5
9e124c92302082bf4d016c1ebc8f7763

SHA1
8f0f2aaea1d5efa2f7856051a7ff2124392b39dd

SHA256
4f4f805eb6d259bc8427fb5f61f9af7aeffbc85e28d9ec74f6947fc7dfc0d47e

SHA512
d504ad9f0474c6467e77a2cb0b0f8f893852dbff28b018c43404b50a570f971ef6373a44674189d53c015d9cd32fc09d678e085af506963ec2e06d107b6d249d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6856.exe

Filesize
468KB

MD5
f59928ded0cf06dbd52447b01718df98

SHA1
536399e0f95f49e2f190ec78908e1fb18903b807

SHA256
dcfb9de4117e76735b18223b3b8d7623246674491753edf98f68b79c4933fb93

SHA512
026d1d7271b265bb1833df2e24f3f9c18b7fbc08bfb1d14b2b4bfe0d964e3a671ed7630d6e2e7f7b3fc6bb9f5c502be9926fbf90b2659c57e2160bf72c30c379

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-762.exe

Filesize
468KB

MD5
9e49767d44a3b2d02b6fbde974460afd

SHA1
86c758b106b24472934ccea2f62e2908d4ee8387

SHA256
b61a7ca54cad2be04a1afee084a5ddcd699bfff6085196070a6ac3d3c8b300df

SHA512
fd103c54dd9b828c842dd3cbe3666e0b2a482a9b66e48250d651f543c6f957a09d51c97159fdd7a1b4e1712628916a1f1ec400e18d76190b46bf37742c01f677

Download Submit
memory/228-336-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/264-389-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/344-374-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/380-82-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/384-290-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/396-98-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/464-96-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/636-444-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/680-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/964-186-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1184-59-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1240-18-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1364-286-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1504-215-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1524-77-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1608-372-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1628-160-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1904-392-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1940-448-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2012-280-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2072-208-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2112-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2236-450-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2248-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2312-207-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2320-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2332-133-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2448-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2484-49-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2488-141-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2492-498-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2644-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2700-397-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2844-391-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2880-360-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3132-261-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3264-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3284-181-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3320-366-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3452-291-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3508-161-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3548-227-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3592-37-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3632-292-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3704-228-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3720-241-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3720-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3912-355-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3976-390-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4016-256-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4064-445-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4080-361-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4092-288-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4116-113-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4148-335-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4212-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4244-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4456-289-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4500-352-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4532-220-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4576-314-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4624-158-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4652-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4716-75-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4724-159-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4732-209-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4772-245-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4884-446-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4920-36-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4936-278-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4968-407-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5000-108-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5008-252-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5032-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5040-78-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5088-162-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5124-492-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5144-457-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5172-458-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5188-494-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5212-459-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5228-488-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5260-503-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5272-490-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5292-491-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5316-493-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5348-505-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5368-495-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5400-496-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5460-504-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5476-497-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5768-529-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5840-530-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5856-531-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5900-538-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5916-539-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads