34830eaa2149530a4936780a1889172f1aec92dcd186eb7326d673c88bf681ee

Analysis

max time kernel
27s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 20:06 UTC

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

34830eaa2149530a4936780a1889172f1aec92dcd186eb7326d673c88bf681ee.exe
Size

468KB
MD5

474e0094071877de95cb6893acb4f82d
SHA1

23d2ada5f25a7595fd913e9193eeff6baa3c524f
SHA256

34830eaa2149530a4936780a1889172f1aec92dcd186eb7326d673c88bf681ee
SHA512

e6abbb436283ffbe4dd19d0be8889d0b65e4093013701aef6c90ce89d1dab8e043c924a4a7252adbe9deada4731b87102f2e27b01cc3882f950fd5dbd0d9af6c
SSDEEP

3072:ECmCogKOjZ8UFbYDPz3yqf+/IRhm4XpTGmHxqlFJG0k5s2oN0zl9:ECro+KUFIPDyqfz5f+G0IvoN0

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1180	Unicorn-36349.exe
4024	Unicorn-53837.exe
3104	Unicorn-23665.exe
3576	Unicorn-56935.exe
1596	Unicorn-32985.exe
4492	Unicorn-22125.exe
4892	Unicorn-5688.exe
2052	Unicorn-60801.exe
3624	Unicorn-63494.exe
2456	Unicorn-7516.exe
4868	Unicorn-27937.exe
3544	Unicorn-8071.exe
1424	Unicorn-27672.exe
2080	Unicorn-21806.exe
1868	Unicorn-15445.exe
3008	Unicorn-14698.exe
4980	Unicorn-16645.exe
3684	Unicorn-43287.exe
4452	Unicorn-50064.exe
4352	Unicorn-57577.exe
3152	Unicorn-39757.exe
3732	Unicorn-55539.exe
3368	Unicorn-51190.exe
1964	Unicorn-2254.exe
4632	Unicorn-46556.exe
2908	Unicorn-62337.exe
4000	Unicorn-40963.exe
4744	Unicorn-43763.exe
1004	Unicorn-49893.exe
4316	Unicorn-40511.exe
4008	Unicorn-62969.exe
4796	Unicorn-19899.exe
1664	Unicorn-61486.exe
532	Unicorn-34097.exe
3316	Unicorn-25929.exe
3804	Unicorn-12114.exe
1408	Unicorn-52955.exe
4600	Unicorn-2363.exe
3004	Unicorn-59732.exe
4832	Unicorn-14060.exe
2152	Unicorn-64942.exe
724	Unicorn-54993.exe
2396	Unicorn-24266.exe
4468	Unicorn-51585.exe
2024	Unicorn-54278.exe
4416	Unicorn-33111.exe
5100	Unicorn-53531.exe
5012	Unicorn-33665.exe
1220	Unicorn-49447.exe
868	Unicorn-49447.exe
1608	Unicorn-14636.exe
2356	Unicorn-41279.exe
3112	Unicorn-50624.exe
4896	Unicorn-19275.exe
4912	Unicorn-19275.exe
3600	Unicorn-65518.exe
4212	Unicorn-26126.exe
2984	Unicorn-55569.exe
2288	Unicorn-29219.exe
312	Unicorn-40079.exe
1968	Unicorn-59945.exe
4292	Unicorn-18647.exe
840	Unicorn-14828.exe
2408	Unicorn-10744.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
6712	2288	WerFault.exe	154
7280	2332	WerFault.exe	281

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61097.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50064.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57577.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30179.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61460.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6064.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59919.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51585.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53531.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10744.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1206.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19494.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27247.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43763.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55569.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52955.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13458.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41279.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61673.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61486.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19275.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33687.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2913.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57589.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13027.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39757.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64942.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33665.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26126.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11683.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63494.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12114.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59535.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62275.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59535.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16365.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25200.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16941.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40829.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43099.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8071.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40511.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54993.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24319.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22514.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63427.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22125.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19899.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14060.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16648.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59732.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59535.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56935.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16645.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4200	34830eaa2149530a4936780a1889172f1aec92dcd186eb7326d673c88bf681ee.exe
1180	Unicorn-36349.exe
4024	Unicorn-53837.exe
3104	Unicorn-23665.exe
3576	Unicorn-56935.exe
1596	Unicorn-32985.exe
4492	Unicorn-22125.exe
4892	Unicorn-5688.exe
2052	Unicorn-60801.exe
3624	Unicorn-63494.exe
2456	Unicorn-7516.exe
2080	Unicorn-21806.exe
3544	Unicorn-8071.exe
1424	Unicorn-27672.exe
4868	Unicorn-27937.exe
1868	Unicorn-15445.exe
3008	Unicorn-14698.exe
4980	Unicorn-16645.exe
3684	Unicorn-43287.exe
4452	Unicorn-50064.exe
4352	Unicorn-57577.exe
3152	Unicorn-39757.exe
3368	Unicorn-51190.exe
3732	Unicorn-55539.exe
1964	Unicorn-2254.exe
2908	Unicorn-62337.exe
4632	Unicorn-46556.exe
1004	Unicorn-49893.exe
4744	Unicorn-43763.exe
4000	Unicorn-40963.exe
4316	Unicorn-40511.exe
4008	Unicorn-62969.exe
1664	Unicorn-61486.exe
4796	Unicorn-19899.exe
532	Unicorn-34097.exe
3316	Unicorn-25929.exe
3804	Unicorn-12114.exe
1408	Unicorn-52955.exe
4600	Unicorn-2363.exe
4832	Unicorn-14060.exe
3004	Unicorn-59732.exe
2152	Unicorn-64942.exe
724	Unicorn-54993.exe
2396	Unicorn-24266.exe
2024	Unicorn-54278.exe
4468	Unicorn-51585.exe
4416	Unicorn-33111.exe
5012	Unicorn-33665.exe
4896	Unicorn-19275.exe
1608	Unicorn-14636.exe
1220	Unicorn-49447.exe
3600	Unicorn-65518.exe
4212	Unicorn-26126.exe
2984	Unicorn-55569.exe
5100	Unicorn-53531.exe
868	Unicorn-49447.exe
4912	Unicorn-19275.exe
3112	Unicorn-50624.exe
2356	Unicorn-41279.exe
312	Unicorn-40079.exe
2408	Unicorn-10744.exe
840	Unicorn-14828.exe
2044	Unicorn-59845.exe
4508	Unicorn-46110.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 1180	4200	34830eaa2149530a4936780a1889172f1aec92dcd186eb7326d673c88bf681ee.exe	91
PID 4200 wrote to memory of 1180	4200	34830eaa2149530a4936780a1889172f1aec92dcd186eb7326d673c88bf681ee.exe	91
PID 4200 wrote to memory of 1180	4200	34830eaa2149530a4936780a1889172f1aec92dcd186eb7326d673c88bf681ee.exe	91
PID 1180 wrote to memory of 4024	1180	Unicorn-36349.exe	94
PID 1180 wrote to memory of 4024	1180	Unicorn-36349.exe	94
PID 1180 wrote to memory of 4024	1180	Unicorn-36349.exe	94
PID 4200 wrote to memory of 3104	4200	34830eaa2149530a4936780a1889172f1aec92dcd186eb7326d673c88bf681ee.exe	95
PID 4200 wrote to memory of 3104	4200	34830eaa2149530a4936780a1889172f1aec92dcd186eb7326d673c88bf681ee.exe	95
PID 4200 wrote to memory of 3104	4200	34830eaa2149530a4936780a1889172f1aec92dcd186eb7326d673c88bf681ee.exe	95
PID 4024 wrote to memory of 3576	4024	Unicorn-53837.exe	97
PID 4024 wrote to memory of 3576	4024	Unicorn-53837.exe	97
PID 4024 wrote to memory of 3576	4024	Unicorn-53837.exe	97
PID 1180 wrote to memory of 1596	1180	Unicorn-36349.exe	98
PID 1180 wrote to memory of 1596	1180	Unicorn-36349.exe	98
PID 1180 wrote to memory of 1596	1180	Unicorn-36349.exe	98
PID 3104 wrote to memory of 4492	3104	Unicorn-23665.exe	99
PID 3104 wrote to memory of 4492	3104	Unicorn-23665.exe	99
PID 3104 wrote to memory of 4492	3104	Unicorn-23665.exe	99
PID 4200 wrote to memory of 4892	4200	34830eaa2149530a4936780a1889172f1aec92dcd186eb7326d673c88bf681ee.exe	101
PID 4200 wrote to memory of 4892	4200	34830eaa2149530a4936780a1889172f1aec92dcd186eb7326d673c88bf681ee.exe	101
PID 4200 wrote to memory of 4892	4200	34830eaa2149530a4936780a1889172f1aec92dcd186eb7326d673c88bf681ee.exe	101
PID 3576 wrote to memory of 2052	3576	Unicorn-56935.exe	103
PID 3576 wrote to memory of 2052	3576	Unicorn-56935.exe	103
PID 3576 wrote to memory of 2052	3576	Unicorn-56935.exe	103
PID 4024 wrote to memory of 3624	4024	Unicorn-53837.exe	104
PID 4024 wrote to memory of 3624	4024	Unicorn-53837.exe	104
PID 4024 wrote to memory of 3624	4024	Unicorn-53837.exe	104
PID 4892 wrote to memory of 2456	4892	Unicorn-5688.exe	105
PID 4892 wrote to memory of 2456	4892	Unicorn-5688.exe	105
PID 4892 wrote to memory of 2456	4892	Unicorn-5688.exe	105
PID 4492 wrote to memory of 4868	4492	Unicorn-22125.exe	106
PID 4492 wrote to memory of 4868	4492	Unicorn-22125.exe	106
PID 4492 wrote to memory of 4868	4492	Unicorn-22125.exe	106
PID 1180 wrote to memory of 2080	1180	Unicorn-36349.exe	108
PID 1180 wrote to memory of 2080	1180	Unicorn-36349.exe	108
PID 1180 wrote to memory of 2080	1180	Unicorn-36349.exe	108
PID 3104 wrote to memory of 3544	3104	Unicorn-23665.exe	107
PID 3104 wrote to memory of 3544	3104	Unicorn-23665.exe	107
PID 3104 wrote to memory of 3544	3104	Unicorn-23665.exe	107
PID 4200 wrote to memory of 1424	4200	34830eaa2149530a4936780a1889172f1aec92dcd186eb7326d673c88bf681ee.exe	109
PID 4200 wrote to memory of 1424	4200	34830eaa2149530a4936780a1889172f1aec92dcd186eb7326d673c88bf681ee.exe	109
PID 4200 wrote to memory of 1424	4200	34830eaa2149530a4936780a1889172f1aec92dcd186eb7326d673c88bf681ee.exe	109
PID 1596 wrote to memory of 1868	1596	Unicorn-32985.exe	110
PID 1596 wrote to memory of 1868	1596	Unicorn-32985.exe	110
PID 1596 wrote to memory of 1868	1596	Unicorn-32985.exe	110
PID 2052 wrote to memory of 3008	2052	Unicorn-60801.exe	111
PID 2052 wrote to memory of 3008	2052	Unicorn-60801.exe	111
PID 2052 wrote to memory of 3008	2052	Unicorn-60801.exe	111
PID 2456 wrote to memory of 4980	2456	Unicorn-7516.exe	112
PID 2456 wrote to memory of 4980	2456	Unicorn-7516.exe	112
PID 2456 wrote to memory of 4980	2456	Unicorn-7516.exe	112
PID 3624 wrote to memory of 3684	3624	Unicorn-63494.exe	113
PID 3624 wrote to memory of 3684	3624	Unicorn-63494.exe	113
PID 3624 wrote to memory of 3684	3624	Unicorn-63494.exe	113
PID 3576 wrote to memory of 4452	3576	Unicorn-56935.exe	114
PID 3576 wrote to memory of 4452	3576	Unicorn-56935.exe	114
PID 3576 wrote to memory of 4452	3576	Unicorn-56935.exe	114
PID 4024 wrote to memory of 4352	4024	Unicorn-53837.exe	115
PID 4024 wrote to memory of 4352	4024	Unicorn-53837.exe	115
PID 4024 wrote to memory of 4352	4024	Unicorn-53837.exe	115
PID 4892 wrote to memory of 3152	4892	Unicorn-5688.exe	116
PID 4892 wrote to memory of 3152	4892	Unicorn-5688.exe	116
PID 4892 wrote to memory of 3152	4892	Unicorn-5688.exe	116
PID 2080 wrote to memory of 3732	2080	Unicorn-21806.exe	117

C:\Users\Admin\AppData\Local\Temp\34830eaa2149530a4936780a1889172f1aec92dcd186eb7326d673c88bf681ee.exe
"C:\Users\Admin\AppData\Local\Temp\34830eaa2149530a4936780a1889172f1aec92dcd186eb7326d673c88bf681ee.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36349.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36349.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53837.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53837.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56935.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60801.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14698.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19899.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10744.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16365.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23329.exe
        10⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10220.exe
        11⤵
        
        PID:9956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22233.exe
        10⤵
        
        PID:10952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57864.exe
        9⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12332.exe
        10⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60699.exe
        9⤵
        
        PID:11616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40053.exe
        8⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13754.exe
        9⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29847.exe
        10⤵
        
        PID:10808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5103.exe
        9⤵
        
        PID:10708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52933.exe
        8⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39730.exe
        8⤵
        
        PID:12152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46110.exe
        7⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59535.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29851.exe
        9⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33167.exe
        8⤵
        
        PID:8188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20309.exe
        9⤵
        
        PID:10704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30768.exe
        8⤵
        
        PID:12712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25200.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29851.exe
        8⤵
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34733.exe
        9⤵
        
        PID:13036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39101.exe
        8⤵
        
        PID:12356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26126.exe
        7⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61917.exe
        8⤵
        
        PID:11040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5567.exe
        7⤵
        
        PID:12664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61486.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14828.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16365.exe
        8⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30283.exe
        9⤵
        
        PID:7456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12332.exe
        10⤵
        
        PID:10496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59137.exe
        9⤵
        
        PID:13244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13515.exe
        8⤵
        
        PID:9152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19959.exe
        9⤵
        
        PID:12452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14596.exe
        8⤵
        
        PID:12968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65055.exe
        7⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50293.exe
        8⤵
        
        PID:8436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56689.exe
        9⤵
        
        PID:14600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25365.exe
        8⤵
        
        PID:13436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9955.exe
        7⤵
        
        PID:9192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59845.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59535.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26391.exe
        8⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12332.exe
        9⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59216.exe
        8⤵
        
        PID:11756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7677.exe
        7⤵
        
        PID:9060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49791.exe
        7⤵
        
        PID:13980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8507.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57117.exe
        7⤵
        
        PID:7272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1074.exe
        8⤵
        
        PID:13548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10015.exe
        7⤵
        
        PID:11940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14528.exe
        6⤵
        
        PID:6756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50064.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52955.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62275.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59919.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22307.exe
        9⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11188.exe
        10⤵
        
        PID:13080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10015.exe
        9⤵
        
        PID:11948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3593.exe
        8⤵
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49791.exe
        8⤵
        
        PID:14004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30323.exe
        7⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19977.exe
        8⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21495.exe
        9⤵
        
        PID:13588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55132.exe
        8⤵
        
        PID:11568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53920.exe
        7⤵
        
        PID:8496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16264.exe
        7⤵
        
        PID:13924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11683.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14802.exe
        7⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53609.exe
        8⤵
        
        PID:8236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30807.exe
        9⤵
        
        PID:10188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32573.exe
        8⤵
        
        PID:11708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34895.exe
        7⤵
        
        PID:8680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25286.exe
        7⤵
        
        PID:13748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14702.exe
        6⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29851.exe
        7⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12332.exe
        8⤵
        
        PID:10488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24546.exe
        7⤵
        
        PID:12856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58798.exe
        6⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39359.exe
        7⤵
        
        PID:8620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31064.exe
        6⤵
        
        PID:12144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54993.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15596.exe
        6⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64387.exe
        7⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57117.exe
        8⤵
        
        PID:672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33939.exe
        9⤵
        
        PID:13272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10015.exe
        8⤵
        
        PID:11932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3593.exe
        7⤵
        
        PID:9092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49791.exe
        7⤵
        
        PID:13996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38875.exe
        6⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4766.exe
        7⤵
        
        PID:8900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58335.exe
        6⤵
        
        PID:10444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22514.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11232.exe
        6⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12332.exe
        7⤵
        
        PID:3948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5103.exe
        6⤵
        
        PID:10656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30096.exe
        5⤵
        
        PID:8880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30073.exe
        6⤵
        
        PID:12824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47969.exe
        5⤵
        
        PID:13280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63494.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43287.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25929.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3152.exe
        7⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41445.exe
        8⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34559.exe
        9⤵
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30435.exe
        9⤵
        
        PID:8692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65046.exe
        8⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19064.exe
        8⤵
        
        PID:13876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5051.exe
        7⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13754.exe
        8⤵
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30807.exe
        9⤵
        
        PID:10112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59137.exe
        8⤵
        
        PID:13232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46903.exe
        7⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51611.exe
        8⤵
        
        PID:11120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22102.exe
        7⤵
        
        PID:12700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48824.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63427.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33791.exe
        8⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6912.exe
        9⤵
        
        PID:13636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33691.exe
        8⤵
        
        PID:11348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15077.exe
        7⤵
        
        PID:8604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49665.exe
        8⤵
        
        PID:11096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65167.exe
        7⤵
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6534.exe
        6⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58440.exe
        7⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36579.exe
        7⤵
        
        PID:13200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26126.exe
        6⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19541.exe
        7⤵
        
        PID:10876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30236.exe
        6⤵
        
        PID:11304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59732.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30179.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12664.exe
        7⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57117.exe
        8⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11188.exe
        9⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40741.exe
        8⤵
        
        PID:11796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3593.exe
        7⤵
        
        PID:8112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50744.exe
        6⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22307.exe
        7⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20885.exe
        8⤵
        
        PID:8796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10015.exe
        7⤵
        
        PID:11908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17328.exe
        6⤵
        
        PID:7860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24930.exe
        6⤵
        
        PID:13916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42715.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61201.exe
        6⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36269.exe
        7⤵
        
        PID:14524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59216.exe
        6⤵
        
        PID:11748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59950.exe
        5⤵
        
        PID:8404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58250.exe
        5⤵
        
        PID:14892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57577.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14060.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3536.exe
        6⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23547.exe
        7⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29851.exe
        8⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18363.exe
        9⤵
        
        PID:10624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40087.exe
        8⤵
        
        PID:12112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-495.exe
        7⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12332.exe
        8⤵
        
        PID:10456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19666.exe
        7⤵
        
        PID:11672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50744.exe
        6⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48565.exe
        7⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44463.exe
        8⤵
        
        PID:12596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51048.exe
        7⤵
        
        PID:11588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20260.exe
        6⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24401.exe
        7⤵
        
        PID:14780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22102.exe
        6⤵
        
        PID:13004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12067.exe
        5⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15186.exe
        6⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13754.exe
        7⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29855.exe
        8⤵
        
        PID:11028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55132.exe
        7⤵
        
        PID:11560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43858.exe
        6⤵
        
        PID:8308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50267.exe
        7⤵
        
        PID:10836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12616.exe
        6⤵
        
        PID:10792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-696.exe
        5⤵
        
        PID:7032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22307.exe
        6⤵
        
        PID:7292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53491.exe
        6⤵
        
        PID:6784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        5⤵
        
        PID:9904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64942.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15596.exe
        5⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15186.exe
        6⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22307.exe
        7⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24811.exe
        8⤵
        
        PID:13068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10015.exe
        7⤵
        
        PID:11880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3593.exe
        6⤵
        
        PID:8204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38875.exe
        5⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55747.exe
        6⤵
        
        PID:8380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25365.exe
        6⤵
        
        PID:13324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4090.exe
        5⤵
        
        PID:9932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19494.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13048.exe
        5⤵
        
        PID:7012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18223.exe
        6⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30807.exe
        7⤵
        
        PID:9792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1847.exe
        6⤵
        
        PID:11724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3593.exe
        5⤵
        
        PID:7296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-411.exe
      4⤵
      PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22307.exe
        5⤵
        
        PID:8144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40741.exe
        5⤵
        
        PID:11968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15058.exe
      4⤵
      PID:8212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60800.exe
      4⤵
      PID:13804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32985.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32985.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15445.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40511.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29219.exe
        6⤵
        Executes dropped EXE
        
        PID:2288
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 716
        7⤵
        Program crash
        
        PID:6712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40053.exe
        6⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61009.exe
        7⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10220.exe
        8⤵
        
        PID:9948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6394.exe
        7⤵
        
        PID:11292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27250.exe
        6⤵
        
        PID:9160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16233.exe
        7⤵
        
        PID:14836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13855.exe
        6⤵
        
        PID:13180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40079.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12280.exe
        6⤵
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54055.exe
        7⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10220.exe
        8⤵
        
        PID:9052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57044.exe
        7⤵
        
        PID:10940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23053.exe
        6⤵
        
        PID:7848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38241.exe
        7⤵
        
        PID:12692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28822.exe
        6⤵
        
        PID:12208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63903.exe
        5⤵
        
        PID:5492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22307.exe
        6⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51035.exe
        7⤵
        
        PID:10692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6428.exe
        6⤵
        
        PID:13108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42899.exe
        5⤵
        
        PID:9328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62969.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59945.exe
        5⤵
        Executes dropped EXE
        
        PID:1968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12280.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54055.exe
        7⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60215.exe
        8⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63676.exe
        7⤵
        
        PID:9464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11280.exe
        7⤵
        
        PID:14040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42025.exe
        6⤵
        
        PID:8804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11188.exe
        7⤵
        
        PID:13888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44966.exe
        6⤵
        
        PID:11552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50168.exe
        5⤵
        
        PID:6152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34559.exe
        6⤵
        
        PID:7372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30435.exe
        6⤵
        
        PID:11180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52139.exe
        5⤵
        
        PID:8492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24930.exe
        5⤵
        
        PID:13908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18647.exe
      4⤵
      Executes dropped EXE
      PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59535.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26199.exe
        6⤵
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39677.exe
        7⤵
        
        PID:13724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62664.exe
        6⤵
        
        PID:11528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13515.exe
        5⤵
        
        PID:9176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60799.exe
        6⤵
        
        PID:12796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7990.exe
        5⤵
        
        PID:13168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6064.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57117.exe
        5⤵
        
        PID:7204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61162.exe
        5⤵
        
        PID:12040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32803.exe
      4⤵
      PID:8004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47521.exe
      4⤵
      PID:13952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21806.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21806.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55539.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49447.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61097.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3894.exe
        7⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60215.exe
        8⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55892.exe
        7⤵
        
        PID:9976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7388.exe
        7⤵
        
        PID:14676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38429.exe
        6⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41497.exe
        7⤵
        
        PID:11176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47427.exe
        6⤵
        
        PID:10884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13027.exe
        5⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2908.exe
        6⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 220
        7⤵
        Program crash
        
        PID:7280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63676.exe
        6⤵
        
        PID:9472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52121.exe
        6⤵
        
        PID:14276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47095.exe
        5⤵
        
        PID:7772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60342.exe
        5⤵
        
        PID:11848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19275.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61097.exe
        5⤵
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48435.exe
        6⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65285.exe
        7⤵
        
        PID:8064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40741.exe
        7⤵
        
        PID:12268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46572.exe
        6⤵
        
        PID:9044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49791.exe
        6⤵
        
        PID:13944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14676.exe
        5⤵
        
        PID:6664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10220.exe
        6⤵
        
        PID:9892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41834.exe
        5⤵
        
        PID:10892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53405.exe
      4⤵
      PID:6020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54055.exe
        5⤵
        
        PID:6416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43879.exe
        6⤵
        
        PID:7888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16613.exe
        5⤵
        
        PID:9508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52121.exe
        5⤵
        
        PID:12308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46738.exe
      4⤵
      PID:7796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12332.exe
        5⤵
        
        PID:3464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51677.exe
      4⤵
      PID:11812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51190.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51190.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41279.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44761.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59701.exe
        6⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17237.exe
        7⤵
        
        PID:7564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48300.exe
        6⤵
        
        PID:9480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28699.exe
        5⤵
        
        PID:7596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54351.exe
        6⤵
        
        PID:11128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4832.exe
        5⤵
        
        PID:11432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54557.exe
      4⤵
      PID:6160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35711.exe
        5⤵
        
        PID:8388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11551.exe
        5⤵
        
        PID:13776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36598.exe
      4⤵
      PID:9860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26126.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26126.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61673.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57947.exe
        5⤵
        
        PID:6920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10220.exe
        6⤵
        
        PID:9920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37121.exe
        5⤵
        
        PID:11268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26945.exe
      4⤵
      PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe
        5⤵
        
        PID:13656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24546.exe
      4⤵
      PID:6856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55066.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55066.exe
    3⤵
    PID:5924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22307.exe
      4⤵
      PID:7188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61162.exe
      4⤵
      PID:4800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29490.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29490.exe
    3⤵
    PID:9796
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23665.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23665.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22125.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22125.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27937.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2254.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33111.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26047.exe
        7⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18223.exe
        8⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61162.exe
        8⤵
        
        PID:12032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17328.exe
        7⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24930.exe
        7⤵
        
        PID:13900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2913.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37875.exe
        7⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64883.exe
        8⤵
        
        PID:12756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5103.exe
        7⤵
        
        PID:10816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32896.exe
        6⤵
        
        PID:8856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50275.exe
        7⤵
        
        PID:11584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7633.exe
        6⤵
        
        PID:13292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33665.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65373.exe
        6⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54657.exe
        7⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10220.exe
        8⤵
        
        PID:10044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44600.exe
        7⤵
        
        PID:10436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14676.exe
        6⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10220.exe
        7⤵
        
        PID:9848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41834.exe
        6⤵
        
        PID:11224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16648.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11232.exe
        6⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31793.exe
        7⤵
        
        PID:11088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5103.exe
        6⤵
        
        PID:10648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38762.exe
        5⤵
        
        PID:8528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15464.exe
        6⤵
        
        PID:11772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51869.exe
        5⤵
        
        PID:12716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46556.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14636.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26047.exe
        6⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57117.exe
        7⤵
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32979.exe
        8⤵
        
        PID:10872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6428.exe
        7⤵
        
        PID:13116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17328.exe
        6⤵
        
        PID:9084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24930.exe
        6⤵
        
        PID:13844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29860.exe
        5⤵
        
        PID:6540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48923.exe
        6⤵
        
        PID:9332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18157.exe
        6⤵
        
        PID:13100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33090.exe
        5⤵
        
        PID:9460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55569.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65373.exe
        5⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35943.exe
        6⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50293.exe
        7⤵
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29855.exe
        8⤵
        
        PID:13240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25365.exe
        7⤵
        
        PID:13332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45699.exe
        6⤵
        
        PID:9516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14676.exe
        5⤵
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55913.exe
        6⤵
        
        PID:10220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28020.exe
        5⤵
        
        PID:11184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49811.exe
      4⤵
      PID:7100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10220.exe
        5⤵
        
        PID:9884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38999.exe
      4⤵
      PID:10424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8071.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8071.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62337.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51585.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5290.exe
        6⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-796.exe
        7⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16853.exe
        8⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44847.exe
        9⤵
        
        PID:12372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22843.exe
        8⤵
        
        PID:13208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24781.exe
        7⤵
        
        PID:9492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52121.exe
        7⤵
        
        PID:13060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65326.exe
        6⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10220.exe
        7⤵
        
        PID:10036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32547.exe
        7⤵
        
        PID:14720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64365.exe
        6⤵
        
        PID:10668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31501.exe
        5⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54055.exe
        6⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7843.exe
        7⤵
        
        PID:11076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29808.exe
        6⤵
        
        PID:12728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40873.exe
        5⤵
        
        PID:7808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11188.exe
        6⤵
        
        PID:1052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22102.exe
        5⤵
        
        PID:12992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54278.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48030.exe
        5⤵
        
        PID:6256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63147.exe
        6⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63684.exe
        7⤵
        
        PID:11892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20129.exe
        6⤵
        
        PID:12132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42409.exe
        5⤵
        
        PID:9316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29590.exe
        5⤵
        
        PID:11020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16648.exe
      4⤵
      PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39665.exe
        5⤵
        
        PID:1404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57283.exe
        6⤵
        
        PID:10156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52960.exe
        5⤵
        
        PID:11008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11927.exe
      4⤵
      PID:7876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19959.exe
        5⤵
        
        PID:12444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57899.exe
      4⤵
      PID:11624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43763.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43763.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61460.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5072.exe
        5⤵
        
        PID:6488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58440.exe
        6⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12332.exe
        7⤵
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23750.exe
        6⤵
        
        PID:11960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13515.exe
        5⤵
        
        PID:9144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37221.exe
        6⤵
        
        PID:3300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48639.exe
        5⤵
        
        PID:12472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56311.exe
      4⤵
      PID:6580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63147.exe
        5⤵
        
        PID:7428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30435.exe
        5⤵
        
        PID:2728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48274.exe
      4⤵
      PID:8940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22486.exe
      4⤵
      PID:13756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65518.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65518.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45337.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23329.exe
        5⤵
        
        PID:6328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43879.exe
        6⤵
        
        PID:7844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5329.exe
        6⤵
        
        PID:13832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39171.exe
        5⤵
        
        PID:9444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54259.exe
        5⤵
        
        PID:13708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27137.exe
      4⤵
      PID:7820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19959.exe
        5⤵
        
        PID:12464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54477.exe
      4⤵
      PID:11872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15602.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15602.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7148.exe
      4⤵
      PID:7352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16067.exe
        5⤵
        
        PID:12340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33691.exe
      4⤵
      PID:11056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9477.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9477.exe
    3⤵
    PID:8612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21905.exe
      4⤵
      PID:12552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3198.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3198.exe
    3⤵
    PID:12848
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5688.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5688.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7516.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7516.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16645.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34097.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13458.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63427.exe
        7⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54055.exe
        8⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49691.exe
        9⤵
        
        PID:10192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45176.exe
        8⤵
        
        PID:11256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33359.exe
        7⤵
        
        PID:7764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22651.exe
        8⤵
        
        PID:12200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30768.exe
        7⤵
        
        PID:6860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65055.exe
        6⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59566.exe
        7⤵
        
        PID:10000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62446.exe
        6⤵
        
        PID:10772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24319.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19079.exe
        6⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45695.exe
        7⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10220.exe
        8⤵
        
        PID:9876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22233.exe
        7⤵
        
        PID:10912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49504.exe
        6⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30615.exe
        7⤵
        
        PID:8600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9360.exe
        6⤵
        
        PID:12056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53789.exe
        5⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57117.exe
        6⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63321.exe
        7⤵
        
        PID:13260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10015.exe
        6⤵
        
        PID:11896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46407.exe
        5⤵
        
        PID:9812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18779.exe
        5⤵
        
        PID:14732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2363.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7620.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50189.exe
        6⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34559.exe
        7⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12174.exe
        8⤵
        
        PID:13088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30435.exe
        7⤵
        
        PID:12088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65046.exe
        6⤵
        
        PID:2268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32269.exe
        5⤵
        
        PID:6644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34559.exe
        6⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17795.exe
        7⤵
        
        PID:14576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61162.exe
        6⤵
        
        PID:12096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52139.exe
        5⤵
        
        PID:6444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24930.exe
        5⤵
        
        PID:13892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21718.exe
      4⤵
      PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-796.exe
        5⤵
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6136.exe
        6⤵
        
        PID:9128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55892.exe
        5⤵
        
        PID:9840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25612.exe
      4⤵
      PID:5696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22307.exe
        5⤵
        
        PID:7180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61162.exe
        5⤵
        
        PID:12080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14528.exe
      4⤵
      PID:8136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30455.exe
      4⤵
      PID:14020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39757.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39757.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12114.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33687.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27247.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22307.exe
        7⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11188.exe
        8⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61162.exe
        7⤵
        
        PID:12048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3593.exe
        6⤵
        
        PID:7660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49791.exe
        6⤵
        
        PID:14012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38491.exe
        5⤵
        
        PID:6372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13754.exe
        6⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54351.exe
        7⤵
        
        PID:11112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21823.exe
        6⤵
        
        PID:11448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14230.exe
        5⤵
        
        PID:7964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22865.exe
        6⤵
        
        PID:12640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25532.exe
        5⤵
        
        PID:11680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9737.exe
      4⤵
      PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16941.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53609.exe
        6⤵
        
        PID:8248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57833.exe
        7⤵
        
        PID:11192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9823.exe
        6⤵
        
        PID:10600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28673.exe
        5⤵
        
        PID:8864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25286.exe
        5⤵
        
        PID:13784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17416.exe
      4⤵
      PID:6340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57117.exe
        5⤵
        
        PID:8172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31191.exe
        6⤵
        
        PID:10968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40741.exe
        5⤵
        
        PID:11976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23194.exe
      4⤵
      PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11188.exe
        5⤵
        
        PID:13252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3436.exe
      4⤵
      PID:13492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24266.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24266.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1206.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64387.exe
        5⤵
        
        PID:6748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57117.exe
        6⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6110.exe
        7⤵
        
        PID:10760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10015.exe
        6⤵
        
        PID:11916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3593.exe
        5⤵
        
        PID:8072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49791.exe
        5⤵
        
        PID:13988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58720.exe
      4⤵
      PID:7004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18223.exe
        5⤵
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23625.exe
        6⤵
        
        PID:11144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5487.exe
        5⤵
        
        PID:11404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13244.exe
      4⤵
      PID:8028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15000.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15000.exe
    3⤵
    PID:7076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57117.exe
      4⤵
      PID:6712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49665.exe
        5⤵
        
        PID:11136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10015.exe
      4⤵
      PID:11924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63530.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63530.exe
    3⤵
    PID:9124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20885.exe
      4⤵
      PID:8420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34117.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34117.exe
    3⤵
    PID:12212
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27672.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27672.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49893.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49893.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49447.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45337.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7340.exe
        6⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10220.exe
        7⤵
        
        PID:10028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22233.exe
        6⤵
        
        PID:11216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13131.exe
        5⤵
        
        PID:8324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12332.exe
        6⤵
        
        PID:10464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59356.exe
        5⤵
        
        PID:12820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21579.exe
      4⤵
      PID:5992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48757.exe
        5⤵
        
        PID:7400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12332.exe
        6⤵
        
        PID:4272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45944.exe
        5⤵
        
        PID:3100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27250.exe
      4⤵
      PID:9168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44847.exe
        5⤵
        
        PID:12364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20461.exe
      4⤵
      PID:12960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19275.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19275.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57589.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64361.exe
        5⤵
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57283.exe
        6⤵
        
        PID:10236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52960.exe
        5⤵
        
        PID:11000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48247.exe
      4⤵
      PID:8908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8017.exe
      4⤵
      PID:4532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43099.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43099.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31497.exe
      4⤵
      PID:6172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34982.exe
        5⤵
        
        PID:9016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44216.exe
      4⤵
      PID:9436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20095.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20095.exe
    3⤵
    PID:7948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16866.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16866.exe
    3⤵
    PID:11660
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40963.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40963.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53531.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53531.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26047.exe
      4⤵
      PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22307.exe
        5⤵
        
        PID:7288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6110.exe
        6⤵
        
        PID:10592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38603.exe
        5⤵
        
        PID:12000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17328.exe
      4⤵
      PID:9200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8017.exe
      4⤵
      PID:13480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13027.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13027.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29851.exe
      4⤵
      PID:8320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe
        5⤵
        
        PID:13616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36579.exe
      4⤵
      PID:13220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26482.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26482.exe
    3⤵
    PID:7904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe
      4⤵
      PID:13676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18018.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18018.exe
    3⤵
    PID:11888
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50624.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50624.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34647.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34647.exe
    3⤵
    PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13048.exe
      4⤵
      PID:6996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20937.exe
        5⤵
        
        PID:8412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25365.exe
        5⤵
        
        PID:12192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31963.exe
      4⤵
      PID:10408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6011.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6011.exe
    3⤵
    PID:6248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22307.exe
      4⤵
      PID:4828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28873.exe
        5⤵
        
        PID:11692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61162.exe
      4⤵
      PID:12280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17328.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17328.exe
    3⤵
    PID:9208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55656.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55656.exe
    3⤵
    PID:14032
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40829.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40829.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33635.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33635.exe
    3⤵
    PID:6992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59566.exe
      4⤵
      PID:11204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29808.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29808.exe
    3⤵
    PID:12740
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27378.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27378.exe
  2⤵
  PID:7704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20885.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20885.exe
    3⤵
    PID:10228
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25341.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25341.exe
  2⤵
  PID:11788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2288 -ip 2288
1⤵
PID:5708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2332 -ip 2332
1⤵
PID:3200

Network

DNS

149.220.183.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

149.220.183.52.in-addr.arpa

IN PTR

Response
DNS

14.160.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

14.160.190.20.in-addr.arpa

IN PTR

Response
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

228.249.119.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

228.249.119.40.in-addr.arpa

IN PTR

Response
DNS

103.169.127.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

103.169.127.40.in-addr.arpa

IN PTR

Response
DNS

206.23.85.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

206.23.85.13.in-addr.arpa

IN PTR

Response
DNS

44.56.20.217.in-addr.arpa

Remote address:

8.8.8.8:53

Request

44.56.20.217.in-addr.arpa

IN PTR

Response

No results found

8.8.8.8:53

149.220.183.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

149.220.183.52.in-addr.arpa
8.8.8.8:53

14.160.190.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

14.160.190.20.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

228.249.119.40.in-addr.arpa

dns

73 B
159 B
1
1

DNS Request

228.249.119.40.in-addr.arpa
8.8.8.8:53

103.169.127.40.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

103.169.127.40.in-addr.arpa
8.8.8.8:53

206.23.85.13.in-addr.arpa

dns

71 B
145 B
1
1

DNS Request

206.23.85.13.in-addr.arpa
8.8.8.8:53

44.56.20.217.in-addr.arpa

dns

71 B
131 B
1
1

DNS Request

44.56.20.217.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-14698.exe

Filesize
468KB

MD5
de414fe793298761fd8fd0e049f6a00b

SHA1
fde203fc313f125a2d6521715df535bb17404138

SHA256
92c9cc7e068f7f58433d487e4c719fefb4091e2c7cf08b3c9353072e23cb4866

SHA512
04d6e63e49bf67bacb2c6923a78d1b8ad774d40357f3911f7a5e9395a5542c83cfe358f3cdecd17a8586edce7f899cbd8054c77dfbb6c441c8c087ee99ee76ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15445.exe

Filesize
468KB

MD5
f0aa329bd48fae35167c64c61953a3ce

SHA1
5e8e964fd9fb72f705730f1041cb0898b4c5a3ca

SHA256
e6583f271049fa8b390e34cf492f47daf7a70b4e1ab620c9271715146a884dec

SHA512
77dbd5e53ec49b5ab892c258188e6d07ca92d501252fe7659ccac83cc1bf788cff6e2ed81bc4385ba4f0c91685a61258ea02858fb830ec672da4ed0cf32af22c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16645.exe

Filesize
468KB

MD5
e2d2297ee30956c4585669df63cab0a9

SHA1
ac8d867b2c75601ffe5fb73e1eedd2fa893ea6a3

SHA256
7d6f081f25be0d129ccd125d373afb08d4f08344e76e590c3072d47f6055855f

SHA512
925150ff8e90e9def3de0bacea24326991701de49b1b6b8a27c8b5dbeb04c0004b9713c06c0f1f6a14766864c1532fa3de130a014bb11d3961f7dd09af2de2da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19899.exe

Filesize
468KB

MD5
a7a72c48db70d0d7ec2cfb390550100f

SHA1
a8c4108a9b7baf907e9d9ca9dcec246288af1535

SHA256
ff806461e04b1b6cca9eda3add63b578a49d213657f24ffad3b90f4373694648

SHA512
4c3fe871b691ce4b3fdf163d2657e9157738755e7bad2a195049b6870230dd29f918d13487f82861edb7ede44f5fd862668a7744da6f63249012216da21e88b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21806.exe

Filesize
468KB

MD5
52a198c8b59f8a4ac0ff1b91ebe1c1cf

SHA1
f9d4b9f8b1acb40f956f81fc0aced7f3a0e1d1bb

SHA256
79adf68dcd337fa57d9d4d0375eb5b1646dc87da5ad01999d043c72717aa6b15

SHA512
4c9ffbdfc42f439d5765e686ce484271744c4f6ea620083be3a72cfb9238ba99e90fca0d16b9e49a1d6332e8bc1c1e07b3e516d8f7864ca505e68965c5d3522e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22125.exe

Filesize
468KB

MD5
40ddbb26805eb05b62668b11af7d517d

SHA1
09505bfdcb911767217f9215d600614d92bd09b0

SHA256
62df8b7aa77e2be0fcb07e79dd7e5ac14ac51a9aca6b6d7b34ff41cfa47e17dd

SHA512
4710139f482c7eefdfd783f4b95e7e3c54e8493789ea49092c1d88457d3dfb3403f2c6d38318e5991e2811b3c5c2bf2348fdbdc9862a9dd112e3226629114e7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2254.exe

Filesize
468KB

MD5
993b9d1240c043d2ca94ed2e25ec2c1b

SHA1
0feea34c227221db5f415844e3a3b5b865643225

SHA256
cedf5d5605aae43c1501cb4971b610d62c927a59cc71b231213aa11ba3ebeebf

SHA512
b6af15fa3f083328b3d74ed61f3c860d56e25e01f9de8bc9419d3a038beee6a8a9bc068c47b3f52f502836cd9fc2412354d77a41cf3bec3f7ab634d512a7c230

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23665.exe

Filesize
468KB

MD5
2e34eabea40be04bb6a0e93e9a109312

SHA1
ace324bba39c97b24f34c922bb4ae8bc4dbebfdc

SHA256
b78a0d12541c1010df2c65c4963b6aaca3094ea6bd14b6d46d9ac76afba33bda

SHA512
e085967c5d8d3103dbbecc28a0523ed83266073a095a69784afcdd0b3b20d686d0449555db639dfc575a68cbd6a9240e935e70665f4c3c086611d01a8dd685c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27672.exe

Filesize
468KB

MD5
ee1ab7c6fcbe631ced2ed9ef9db0fed2

SHA1
155b465ce4e03c1c2d82770d8ad11474c041d4f5

SHA256
57994eee01d35a13624f76b9ca6328ee4f290ec8b30684ffd35f3abf06594188

SHA512
3dd15d332944e21b15b3e5128c2b16bf3e3238dfb8a01e778e340f1fcdb2759bcd101205a22a98e116858adace884e5808f3ac0ed6da218d17338cb185fd1202

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27937.exe

Filesize
468KB

MD5
7c5f62af5bbcae3b9f1013aae4ad3416

SHA1
0aac2575898c033137a2adc65afc5d2d097ad225

SHA256
a819e2f374d970a8bf467b549c0a9ed0cdadde7ded45208ed6becf88b463cb89

SHA512
0692d079552c59fbee4e08624cd3610c80df643a10a54a38dc986ec3bbd81dae9f494c477c18b48cca89ec806a85a85e6e0391388774f5f1bec34dd8d1cc50c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32985.exe

Filesize
468KB

MD5
4c6eb933a12487e1825ec498928ecc5b

SHA1
05b2502d85e6b3f98cc9192639a7fac39836e1a9

SHA256
0f5a790471c1425e876e90fcc01a0ee0f873a836de41f74c42a1483cf9d2d160

SHA512
23252f715de196342c6f52142a4f38e25043cb8459ede48f6d0c6068acd27ca5dc884c84324036deaca7dba688f60e0fe23fafad95d19273312f632319e12192

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33687.exe

Filesize
468KB

MD5
126bf0ae078acb5ca7ed96d6b14c9b7a

SHA1
c4b6270fd55360755f00ed791f10f8629115c696

SHA256
a5e3bd673d11e1e1c9520fc799febe28e3d7514eadf8c03e970c9d756ef9846b

SHA512
f541054ceeafe3b9dbcae468667c9f20f4439bbf268c31989b90bf497deb40809bda38a08d73ef7ed82b304b7b99ea7226d0a60b970d04cd862ca83c05af7d79

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36349.exe

Filesize
468KB

MD5
595a4c4784221c6a2aec330cb7e11e28

SHA1
6ef55011d82bc1b274bb974ba94a0bdf4213dd05

SHA256
a657ae1279b464e2912edf3ded811c6e277cfc5482a6cdbf3d97e3d97a98efe4

SHA512
7031b8f0e118ccd9ec2eab8a39a3d012c1a7b5c87f600547bda8a9f7a45e3a580a58f56cb4a0c7f7b308134fba8faa4e6d471c22f3a16f28b0309c600142e74f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39757.exe

Filesize
468KB

MD5
44e242c38f1a3100f654cebf1d9bf416

SHA1
14a3d25a8547bf7886c2b4279990d12c88be7a06

SHA256
04582844ff1eccdf965f7965342ab91f93854cee94afb5d0b9ea6b3457103a51

SHA512
59c1c8a945e656f88a5aa447d5c6c77ac1bc2a0c9fa56207ff530d131110a970e3dd5e340b7f296a7fb9809bdb9628b81967868ca9275df3633fe795e7590fda

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40511.exe

Filesize
468KB

MD5
4af75134aa82661b9db6fc0a6e1c056e

SHA1
bfb86dc71f9f55dd8310232593889cd3bd0a9687

SHA256
a84583d4a951a17b08011dd153c82fb472ac48dd7ffb08a510bbb30940a2e068

SHA512
b20d75ece5ed12180587c6019e7fc3a3b599f09c2d26f7d7fc81a3af8cfe14b5f43ca550f5d250d9a7679be8d0837798907fee01777b1d4dd18bb57f71250f00

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40963.exe

Filesize
468KB

MD5
24b7199cb8a8294f0a86d6a6bec5fcec

SHA1
b219f5d7e49be1ea2d7634ab4a7e8474f127c39c

SHA256
1c548446904d34e4ba9b7290d767662ef8e00a78ecedc799d34a44f7b6fb3391

SHA512
384694f9c5cfb20d13e503ad47b71c5b63524609e968f81521e3a7e1429c914871d1a1b92d0ba04832cc99e1d9dc3682e8f82f0a7ff9324f91794c806f15a7a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43287.exe

Filesize
468KB

MD5
43d184a6e40ee1570a0430d24c61e356

SHA1
b18fe9c391e7664208dcf02c53aacb4eaa9b7158

SHA256
de0a729f0aea837de1752462dee798cdb9a24139762bf375db3f3e2b332e729c

SHA512
03c8ae84bda48ec859c0f6c9eec8ab7b449f0db11aac836667fff67bda5345b43a9a8ec8c9c1832a54cd1df70ede6f9ea9875c0d40db412d52c857c612d2c7c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43763.exe

Filesize
468KB

MD5
49391c3535a5f49341dd71c3b4a7834f

SHA1
1516d95252b7e9272161ec9f7e6178e0230610dc

SHA256
69b85408268440497c0aeb45933dcefed9e227271cfa1a8ee58aea962c673242

SHA512
c831e520671f9bece10b2eb417c547072686646dc495aba04d55d8c7158667561631d5fae2abe63701af629592e194cdc5c781c88467fdd320677058748119df

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46556.exe

Filesize
468KB

MD5
bb8b6a633a550d81debface6959fe6e3

SHA1
82b23b97dcc928dccb56ecaa3016e0c9ff8a25d6

SHA256
31ca20193b98083c0729b33c9254262255361323278759001139e0e84ffdc913

SHA512
b86e292c54df32da8f6e9a38b8fc2d7cfdefac7fa777a52f75a238145781e5fe0cfce13aefc0419c39a14c583cb1c06c374cd84dcd4aeccca71c0d4d8b06ac4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49893.exe

Filesize
468KB

MD5
13784d8c476997dcf2cc029c032d72ad

SHA1
6c968a4c1bd5af83d60a9244161dff3790e36806

SHA256
cfe3b0bed76d96b0e2d29f99fc4f67b86e456479fb88bd5c5e6f410b81c6c967

SHA512
c7a45a78d03abaec74e674e85964dc03c666fadd566c120f8a3e085dca1316ac36d7620c12ee4a8d130ad172eaba1d77d9aa572054dcf16f430be6b82e686e04

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50064.exe

Filesize
468KB

MD5
661cefbe906dad172a48cb5fff6a6746

SHA1
5a58b276909a29668764dc094f4cc5c0a45fc513

SHA256
dc22523afa7e37c809c1848b1fa3832c2e4b2a1443fb41480f917b6d45db07ce

SHA512
75ee4379cd0b4bde7e7cac3cb54327fb5df9ba1704a744238a617f3bb1958400a5a675ba0df2a5c7ab090e08fddb4bd1eba9089fc9ef4225403d842e292e6b7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51190.exe

Filesize
468KB

MD5
3a2397081f50e6674bec9318c5b6e71a

SHA1
5dc1810cbd5c400175f62653def7ec8a43318cc5

SHA256
42ca6b182287a06e74a844655123552356bd90645b495f4c419297a91c8f2343

SHA512
78630d10a2316069ee0650932ef13d62eb842392b0f68cdeb6a46eb14db3aadeb76cf74fe271a0e2c3ff488bc3085ee9183e039c884789bdcbb17c802c712a87

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53837.exe

Filesize
468KB

MD5
342ae1b1ebd8ff8e4266f1183b39fd96

SHA1
3b765d08d78945671fb51201ebd346aeb99f7d18

SHA256
1ac009852021de45875506f7f8a6adadf5267fd5282fe0ad984f91c404f45368

SHA512
75e71d37e4afeb92676dcf3b8b8e12671fd74a9c12c3e91640b95562ce2aa66e24424f223c0954406fabc58fcb800c114269dc114b2aed8e2216fbb75bd25bb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54055.exe

Filesize
468KB

MD5
e64a02b819c1e8b9c415dac6cd140dd2

SHA1
7abfa0e997e2c5f78894136b0365a436de3af7fb

SHA256
eb254003b925cbfcf2cce1afd0ae7739d7be1fa1fb3d1cc5922aacdd75d69426

SHA512
e096208d654ca39f4461be561c19f9f2f510d37c571be875af5a83c0d2b9608cc615dc8c85cdd4e7fce9445e060531456823a0be718440f91e08679b1ce464ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55539.exe

Filesize
468KB

MD5
a8d1b22158a3a64721412ac2bf426c6c

SHA1
7d1b0d73ef96d9a790babdcc45a4f6cb9bea1299

SHA256
34f3f766e4912984fc4ebaa24e1cedb427c4f376c5ea5802307f868f16e408f0

SHA512
784834061ebd833f34d92d6f0a994b8526747b51d648cafccf210563effd6eb1a3fe67c3db5fc193d20f78213eeb3d4af102acf162b2e6873f95aa5d687bd83e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5688.exe

Filesize
468KB

MD5
2830fff162a12a02efe7bf37ed7d2768

SHA1
f36a004d9f3aab4782014edcbd01d0504e14ad37

SHA256
600b20fcdfec80d6c889c983b7c02aaf4d1c9d6dc73a3ba1850bcd68be505b40

SHA512
b9f7adb164a8a55843fbcfde35c59ef6324d88c0131ed2673dbccc49eea41ef2b5a8334c8fcb9a12eb4c501d4d88cd856869f327d69373cf5c04e49062cd8f7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56935.exe

Filesize
468KB

MD5
2e32cf8acc0817709fa3d8fc4fd09482

SHA1
64584d1c6f4c4340f43ca0e70858f546c860a50c

SHA256
450b8d211b33c14d5521a4788f9eb2e051b1ab14e9f88b205d2627ab91114cdd

SHA512
aa83633888a11bf9ddd4077c518109f96b84b956b6d631548990eef32db02e713fed6f89178318c6575e5cc8cba5f7caffe45f4437005f18bf74198de4cf7f78

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57577.exe

Filesize
468KB

MD5
c5d31d9a68d897e8394c66a563a0f137

SHA1
d212567d02c3127cba33e83e284b810d930bd35f

SHA256
5a46ed52423df0da01841a74d943c0359a3581f930e610cea0b344e6e1319a4f

SHA512
8d0fb08376aa66def2db3082f2047b43efa92cc47a08b7f12e12d85e567d8639e540b1922cd43e1d620f727c05cb93b4d27280dd8fb7a6071309f22b568eb307

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60799.exe

Filesize
468KB

MD5
b49cc6862de58bf80ebdeafc8979aa39

SHA1
9453fd1dfd13de16ef1ff0e5311870000ccc9f5d

SHA256
dea0ae2789952e08ed952971a40600a183d319a28a056aeefb50686b0dc0b7fc

SHA512
8b80ac1d1387212fc3c397b84bd8bd0c5127808f98269397bd40007e67e740f9cfd25a3a97cdfeaf8f58a5a4e97b3772824f6049e71cb9ab9ae619d9bffbb776

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60801.exe

Filesize
468KB

MD5
fd4ca200c2ad3afe61328531d5124828

SHA1
f05bfd44a4ab1d4d5db7f6f7a353c5878fd2e889

SHA256
5c0f975329f5dceb08df5fb0d4060dda4eea347a13bad71036e8f45d4489f468

SHA512
49556feb9bf81b97dd83ecc300cf5f329558c9c3104df91ed660afd8b08e85eeb4b79be340b37b283466a3947e77b18ed796e078c1fa18e54f5f8a3060e12b7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62337.exe

Filesize
468KB

MD5
67cc2012ad22942168ef9ee589cf4f2c

SHA1
82ce79cca05567d71e0f268c0828c43a1ddd4231

SHA256
e11e283b5ede683d9465fd59fb8ecc7b082bfc58141b1243b3eb430a0a1b7ad0

SHA512
d5a15de3a05c86d32f655770eded2f72440e61a75456e6ab615b2938bb7eb4e2da709fd2ee95db3f607eb8ff9793a6f8fa56ea98501563125b8263b857dafcb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62969.exe

Filesize
468KB

MD5
9a9c1af6a42552d8e64d2c58f695b938

SHA1
fffba9cb3c92ebe7cf419e94e8e4aac4f9923ab3

SHA256
caa959fad4e56c3c5d1c4086953229393cfe71158795faedfe838dc656ec4824

SHA512
b9f835158490035ecc38621ddbc157f74b06f082b80d6a84e8285936be3090bdeedf5f36a0e1558f927ed738a02baf378767a1c0a65c8149ab735bf909fac20c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63494.exe

Filesize
468KB

MD5
107a3d88565f03d378fc13305359c6d6

SHA1
9f68181ab9f3babdedb519e2932d441691584e91

SHA256
bbdbec1c9d5534b7dff5c5655c0de03ebbe8750af2e47ab2477467849f543296

SHA512
ce4bd897bbad81ded16e0dede423096302f4042a8ae361ab648d260e9b74a68493c61f84556da82fcc194df10cb03ba1292e9956f6f1cef745b1f9939cfed03f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6394.exe

Filesize
468KB

MD5
b37fbce4e7f994a11bc79e95ed93b459

SHA1
fccdb1755898d9c5b063a89787f9000394c6f70a

SHA256
4cd43797bce7ef481f602b66a6bf084d168b1f6d35fd3193a16d856e0446c2d0

SHA512
75940e5e4bd72bc5d7195197601832f1b13c36f93e9fc49f931ca46c455f4c2f4c48bfcb0730c641113f94f513a91d31fcd676d7a3497492afb3a53dd5a8b037

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7516.exe

Filesize
468KB

MD5
64b753535dc69bf01675c031501bf837

SHA1
6c1bb933c563271cbef9fedf2f48c13a403a6ca8

SHA256
c4d7150b6f06c0f59e489442d16aba469d8083303268d91b182d8e9014ad551a

SHA512
bfce00ac668c279e40c42f136e7eac45f888f86bc51861a50811caea0ca91357e3436ac986c0d17ccd6b86c99e1bb9218ad33628e28bd5c5254e1cee6622c420

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8071.exe

Filesize
468KB

MD5
5cca595145d8226f942491b48f73bfd1

SHA1
5e8fe6a9862db04aa70a8853ba3ea6eecbf48308

SHA256
85173d8c42421bb357a3146655f600826f7b1985b2585503d7d728bbec0965c2

SHA512
cb8f5bc9c72232507b4893ff581c8f2d025a8b2f3de1e0b44aa183335befde72879b1de13719911bb291ea41044be7dd98c73d2ff5f488561e0970a36976944d

Download Submit
memory/312-372-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/532-237-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/724-279-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/840-375-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1004-204-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1180-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1220-320-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1408-252-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1424-100-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1532-415-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1596-34-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1608-346-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1664-229-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1868-106-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1964-176-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1968-373-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2024-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2044-377-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2052-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2080-101-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2152-272-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2288-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2340-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2356-322-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2396-280-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2408-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2456-73-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2908-180-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2984-344-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3004-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3008-114-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3028-445-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3104-18-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3112-347-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3152-156-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3224-421-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3316-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3368-161-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3544-94-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3576-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3600-338-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3604-414-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3624-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3684-127-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3732-158-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3768-431-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3804-245-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3952-417-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4000-193-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4008-219-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4024-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4044-422-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4200-532-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4200-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4212-343-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4292-374-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4316-212-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4352-150-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4416-291-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4452-144-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4468-281-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4492-41-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4508-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4600-253-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4632-177-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4744-196-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4756-439-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4796-227-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4832-270-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4868-91-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4892-47-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4896-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4912-324-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4980-123-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5012-345-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5100-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5104-434-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5124-440-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5188-446-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5272-464-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5280-466-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5292-467-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5312-468-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5332-469-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5360-470-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5432-486-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5448-489-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5536-503-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5584-507-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5616-523-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5652-521-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5660-522-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5700-535-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5732-536-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5752-537-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5760-538-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14576-2338-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.