cfd6b29efb38b69f0b5ff7b0e7af032bd9bfa8c4e5c0db0418e41eed506ccc26

Analysis

max time kernel
120s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15/09/2024, 09:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4bc06e73e89b4d5adcc1d7e9513d6490N.exe
Size

468KB
MD5

4bc06e73e89b4d5adcc1d7e9513d6490
SHA1

f9896335c74f2b30a624f77faaa78ed7d23807cf
SHA256

cfd6b29efb38b69f0b5ff7b0e7af032bd9bfa8c4e5c0db0418e41eed506ccc26
SHA512

7c86afe0d5f05ecb405a5ce9c29cc52c65a5e56155c3e2f9395f406ab6bcf0248d1d74a1b8c2e9a974bfd2eb2c68db72fc02c23b0dba7ad276cc1dc1cb019385
SSDEEP

3072:yqktog7xjy8U2bYePzsyqfU/Ekhjj+plPmHXLVIQdMLGgdJNQOlj:yqmoQLU2dPoyqf0uOzdMygJNQ

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
688	Unicorn-24887.exe
3916	Unicorn-59863.exe
3364	Unicorn-35913.exe
1864	Unicorn-25183.exe
4116	Unicorn-49687.exe
1240	Unicorn-29821.exe
1436	Unicorn-35389.exe
1556	Unicorn-12302.exe
3444	Unicorn-12302.exe
592	Unicorn-36807.exe
3264	Unicorn-36807.exe
1100	Unicorn-22508.exe
2248	Unicorn-8773.exe
4780	Unicorn-8773.exe
4544	Unicorn-52878.exe
4356	Unicorn-34991.exe
512	Unicorn-19017.exe
4024	Unicorn-6018.exe
1452	Unicorn-22909.exe
2580	Unicorn-63195.exe
4548	Unicorn-21652.exe
2172	Unicorn-27783.exe
380	Unicorn-31867.exe
3872	Unicorn-19615.exe
516	Unicorn-23699.exe
4452	Unicorn-37989.exe
1752	Unicorn-24253.exe
1700	Unicorn-39770.exe
4664	Unicorn-31104.exe
3560	Unicorn-20169.exe
4480	Unicorn-8514.exe
2696	Unicorn-54186.exe
4904	Unicorn-8322.exe
1412	Unicorn-26696.exe
3504	Unicorn-65499.exe
3620	Unicorn-14305.exe
3332	Unicorn-6137.exe
2924	Unicorn-26003.exe
4668	Unicorn-32124.exe
3484	Unicorn-13558.exe
3136	Unicorn-55146.exe
4232	Unicorn-49169.exe
2136	Unicorn-54015.exe
464	Unicorn-8898.exe
1748	Unicorn-22687.exe
1164	Unicorn-39023.exe
1156	Unicorn-49229.exe
1140	Unicorn-55094.exe
4912	Unicorn-4112.exe
2600	Unicorn-10242.exe
956	Unicorn-22495.exe
772	Unicorn-31217.exe
3596	Unicorn-63335.exe
2200	Unicorn-63335.exe
1580	Unicorn-63335.exe
4660	Unicorn-31217.exe
3380	Unicorn-59251.exe
3628	Unicorn-63890.exe
1224	Unicorn-50122.exe
2824	Unicorn-9785.exe
4932	Unicorn-55722.exe
824	Unicorn-35131.exe
2412	Unicorn-27517.exe
2100	Unicorn-45337.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
11604	9884	WerFault.exe	529
12224	10456	WerFault.exe	528
10308	10472	WerFault.exe	530
12252	10428	WerFault.exe	527
15176	7328	WerFault.exe	310
8904	2652	WerFault.exe	814

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29156.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44017.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1543.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12606.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53515.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59114.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52317.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23699.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15589.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26441.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52222.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37753.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62176.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58782.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17635.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29390.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6478.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6292.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53950.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15533.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29821.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42737.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36447.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3026.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13630.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1122.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27909.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22508.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63233.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60074.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43249.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45840.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25435.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63115.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12061.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-226.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47376.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5627.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13558.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61070.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3220.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63862.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54828.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4807.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29792.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41217.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56151.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63587.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18589.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56182.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60074.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6587.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26003.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38869.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49778.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9954.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20770.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42795.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42531.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39770.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16256	dwm.exe
Token: SeChangeNotifyPrivilege	16256	dwm.exe
Token: 33	16256	dwm.exe
Token: SeIncBasePriorityPrivilege	16256	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3740	4bc06e73e89b4d5adcc1d7e9513d6490N.exe
688	Unicorn-24887.exe
3916	Unicorn-59863.exe
3364	Unicorn-35913.exe
1240	Unicorn-29821.exe
4116	Unicorn-49687.exe
1864	Unicorn-25183.exe
1436	Unicorn-35389.exe
1556	Unicorn-12302.exe
592	Unicorn-36807.exe
1100	Unicorn-22508.exe
2248	Unicorn-8773.exe
3444	Unicorn-12302.exe
3264	Unicorn-36807.exe
4780	Unicorn-8773.exe
4544	Unicorn-52878.exe
4356	Unicorn-34991.exe
512	Unicorn-19017.exe
4024	Unicorn-6018.exe
1452	Unicorn-22909.exe
2580	Unicorn-63195.exe
4548	Unicorn-21652.exe
3872	Unicorn-19615.exe
4664	Unicorn-31104.exe
1700	Unicorn-39770.exe
1752	Unicorn-24253.exe
2172	Unicorn-27783.exe
3560	Unicorn-20169.exe
4452	Unicorn-37989.exe
380	Unicorn-31867.exe
516	Unicorn-23699.exe
4480	Unicorn-8514.exe
2696	Unicorn-54186.exe
4904	Unicorn-8322.exe
1412	Unicorn-26696.exe
3504	Unicorn-65499.exe
2924	Unicorn-26003.exe
3620	Unicorn-14305.exe
3332	Unicorn-6137.exe
3484	Unicorn-13558.exe
4668	Unicorn-32124.exe
3136	Unicorn-55146.exe
4232	Unicorn-49169.exe
2136	Unicorn-54015.exe
464	Unicorn-8898.exe
1748	Unicorn-22687.exe
1164	Unicorn-39023.exe
1156	Unicorn-49229.exe
1140	Unicorn-55094.exe
4912	Unicorn-4112.exe
2600	Unicorn-10242.exe
956	Unicorn-22495.exe
3596	Unicorn-63335.exe
4932	Unicorn-55722.exe
1224	Unicorn-50122.exe
2824	Unicorn-9785.exe
1580	Unicorn-63335.exe
2200	Unicorn-63335.exe
3380	Unicorn-59251.exe
772	Unicorn-31217.exe
4660	Unicorn-31217.exe
824	Unicorn-35131.exe
2412	Unicorn-27517.exe
1644	Unicorn-59635.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3740 wrote to memory of 688	3740	4bc06e73e89b4d5adcc1d7e9513d6490N.exe	91
PID 3740 wrote to memory of 688	3740	4bc06e73e89b4d5adcc1d7e9513d6490N.exe	91
PID 3740 wrote to memory of 688	3740	4bc06e73e89b4d5adcc1d7e9513d6490N.exe	91
PID 688 wrote to memory of 3916	688	Unicorn-24887.exe	94
PID 688 wrote to memory of 3916	688	Unicorn-24887.exe	94
PID 688 wrote to memory of 3916	688	Unicorn-24887.exe	94
PID 3740 wrote to memory of 3364	3740	4bc06e73e89b4d5adcc1d7e9513d6490N.exe	95
PID 3740 wrote to memory of 3364	3740	4bc06e73e89b4d5adcc1d7e9513d6490N.exe	95
PID 3740 wrote to memory of 3364	3740	4bc06e73e89b4d5adcc1d7e9513d6490N.exe	95
PID 3916 wrote to memory of 1864	3916	Unicorn-59863.exe	97
PID 3916 wrote to memory of 1864	3916	Unicorn-59863.exe	97
PID 3916 wrote to memory of 1864	3916	Unicorn-59863.exe	97
PID 3364 wrote to memory of 4116	3364	Unicorn-35913.exe	99
PID 3364 wrote to memory of 4116	3364	Unicorn-35913.exe	99
PID 3364 wrote to memory of 4116	3364	Unicorn-35913.exe	99
PID 688 wrote to memory of 1240	688	Unicorn-24887.exe	98
PID 688 wrote to memory of 1240	688	Unicorn-24887.exe	98
PID 688 wrote to memory of 1240	688	Unicorn-24887.exe	98
PID 3740 wrote to memory of 1436	3740	4bc06e73e89b4d5adcc1d7e9513d6490N.exe	100
PID 3740 wrote to memory of 1436	3740	4bc06e73e89b4d5adcc1d7e9513d6490N.exe	100
PID 3740 wrote to memory of 1436	3740	4bc06e73e89b4d5adcc1d7e9513d6490N.exe	100
PID 4116 wrote to memory of 3444	4116	Unicorn-49687.exe	103
PID 4116 wrote to memory of 3444	4116	Unicorn-49687.exe	103
PID 4116 wrote to memory of 3444	4116	Unicorn-49687.exe	103
PID 1240 wrote to memory of 1556	1240	Unicorn-29821.exe	104
PID 1240 wrote to memory of 1556	1240	Unicorn-29821.exe	104
PID 1240 wrote to memory of 1556	1240	Unicorn-29821.exe	104
PID 1864 wrote to memory of 3264	1864	Unicorn-25183.exe	106
PID 1864 wrote to memory of 3264	1864	Unicorn-25183.exe	106
PID 1864 wrote to memory of 3264	1864	Unicorn-25183.exe	106
PID 1436 wrote to memory of 592	1436	Unicorn-35389.exe	105
PID 1436 wrote to memory of 592	1436	Unicorn-35389.exe	105
PID 1436 wrote to memory of 592	1436	Unicorn-35389.exe	105
PID 3916 wrote to memory of 2248	3916	Unicorn-59863.exe	108
PID 3916 wrote to memory of 2248	3916	Unicorn-59863.exe	108
PID 3916 wrote to memory of 2248	3916	Unicorn-59863.exe	108
PID 688 wrote to memory of 1100	688	Unicorn-24887.exe	107
PID 688 wrote to memory of 1100	688	Unicorn-24887.exe	107
PID 688 wrote to memory of 1100	688	Unicorn-24887.exe	107
PID 3364 wrote to memory of 4780	3364	Unicorn-35913.exe	109
PID 3364 wrote to memory of 4780	3364	Unicorn-35913.exe	109
PID 3364 wrote to memory of 4780	3364	Unicorn-35913.exe	109
PID 3740 wrote to memory of 4544	3740	4bc06e73e89b4d5adcc1d7e9513d6490N.exe	110
PID 3740 wrote to memory of 4544	3740	4bc06e73e89b4d5adcc1d7e9513d6490N.exe	110
PID 3740 wrote to memory of 4544	3740	4bc06e73e89b4d5adcc1d7e9513d6490N.exe	110
PID 1556 wrote to memory of 4356	1556	Unicorn-12302.exe	111
PID 1556 wrote to memory of 4356	1556	Unicorn-12302.exe	111
PID 1556 wrote to memory of 4356	1556	Unicorn-12302.exe	111
PID 1240 wrote to memory of 512	1240	Unicorn-29821.exe	112
PID 1240 wrote to memory of 512	1240	Unicorn-29821.exe	112
PID 1240 wrote to memory of 512	1240	Unicorn-29821.exe	112
PID 592 wrote to memory of 4024	592	Unicorn-36807.exe	113
PID 592 wrote to memory of 4024	592	Unicorn-36807.exe	113
PID 592 wrote to memory of 4024	592	Unicorn-36807.exe	113
PID 1436 wrote to memory of 1452	1436	Unicorn-35389.exe	114
PID 1436 wrote to memory of 1452	1436	Unicorn-35389.exe	114
PID 1436 wrote to memory of 1452	1436	Unicorn-35389.exe	114
PID 4780 wrote to memory of 2580	4780	Unicorn-8773.exe	115
PID 4780 wrote to memory of 2580	4780	Unicorn-8773.exe	115
PID 4780 wrote to memory of 2580	4780	Unicorn-8773.exe	115
PID 3364 wrote to memory of 4548	3364	Unicorn-35913.exe	116
PID 3364 wrote to memory of 4548	3364	Unicorn-35913.exe	116
PID 3364 wrote to memory of 4548	3364	Unicorn-35913.exe	116
PID 2248 wrote to memory of 2172	2248	Unicorn-8773.exe	117

C:\Users\Admin\AppData\Local\Temp\4bc06e73e89b4d5adcc1d7e9513d6490N.exe
"C:\Users\Admin\AppData\Local\Temp\4bc06e73e89b4d5adcc1d7e9513d6490N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24887.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24887.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59863.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59863.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25183.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36807.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31867.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63335.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21351.exe
        8⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40095.exe
        9⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe
        10⤵
        
        PID:9684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7993.exe
        10⤵
        
        PID:10488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28848.exe
        10⤵
        
        PID:14732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58860.exe
        10⤵
        
        PID:16312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56182.exe
        9⤵
        
        PID:11012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8891.exe
        9⤵
        
        PID:384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4661.exe
        8⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46949.exe
        8⤵
        
        PID:11508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55047.exe
        8⤵
        
        PID:17752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17629.exe
        7⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31927.exe
        8⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-266.exe
        9⤵
        
        PID:10432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9954.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:19032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4677.exe
        9⤵
        
        PID:13288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56311.exe
        9⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63774.exe
        8⤵
        
        PID:9884
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9884 -s 220
        9⤵
        Program crash
        
        PID:11604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8891.exe
        8⤵
        
        PID:14508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28100.exe
        7⤵
        
        PID:8912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16057.exe
        7⤵
        
        PID:12400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25498.exe
        7⤵
        
        PID:1640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55722.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21351.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44179.exe
        8⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20495.exe
        9⤵
        
        PID:9736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7993.exe
        9⤵
        
        PID:14172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38056.exe
        9⤵
        
        PID:16464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26441.exe
        8⤵
        
        PID:10572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8891.exe
        8⤵
        
        PID:15236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16913.exe
        7⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22955.exe
        8⤵
        
        PID:11472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11029.exe
        8⤵
        
        PID:14800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29450.exe
        8⤵
        
        PID:17020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8656.exe
        7⤵
        
        PID:11440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61392.exe
        7⤵
        
        PID:1960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31364.exe
        6⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29275.exe
        7⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63115.exe
        8⤵
        
        PID:8988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42575.exe
        9⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65501.exe
        8⤵
        
        PID:13484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29390.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29409.exe
        7⤵
        
        PID:9768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7272.exe
        7⤵
        
        PID:7660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27386.exe
        6⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22955.exe
        7⤵
        
        PID:11536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12667.exe
        7⤵
        
        PID:8724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49437.exe
        6⤵
        
        PID:10840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54041.exe
        6⤵
        
        PID:15936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24253.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39023.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20199.exe
        7⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53203.exe
        8⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22.exe
        9⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6478.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:13452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3026.exe
        10⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7365.exe
        9⤵
        
        PID:10272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17635.exe
        9⤵
        
        PID:16496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3073.exe
        8⤵
        
        PID:7900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13878.exe
        9⤵
        
        PID:13268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40411.exe
        9⤵
        
        PID:16960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2984.exe
        8⤵
        
        PID:12868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4615.exe
        8⤵
        
        PID:15828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43966.exe
        7⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18471.exe
        8⤵
        
        PID:8416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53951.exe
        9⤵
        
        PID:14076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42575.exe
        9⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37873.exe
        8⤵
        
        PID:11272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3026.exe
        8⤵
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-472.exe
        7⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50744.exe
        8⤵
        
        PID:15396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49882.exe
        7⤵
        
        PID:12764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-226.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37753.exe
        6⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24387.exe
        7⤵
        
        PID:10164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31246.exe
        7⤵
        
        PID:9092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62850.exe
        6⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55980.exe
        7⤵
        
        PID:16020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3220.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40493.exe
        6⤵
        
        PID:14928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37513.exe
        6⤵
        
        PID:15704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4112.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1122.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27355.exe
        7⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28803.exe
        8⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7365.exe
        8⤵
        
        PID:10616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30272.exe
        8⤵
        
        PID:15852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56358.exe
        7⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56234.exe
        7⤵
        
        PID:14032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42795.exe
        7⤵
        
        PID:19336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29445.exe
        6⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59503.exe
        7⤵
        
        PID:8352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1543.exe
        8⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4049.exe
        7⤵
        
        PID:11904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8891.exe
        7⤵
        
        PID:4924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49481.exe
        6⤵
        
        PID:8248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39483.exe
        7⤵
        
        PID:11276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32190.exe
        7⤵
        
        PID:16508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12741.exe
        6⤵
        
        PID:13056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12286.exe
        6⤵
        
        PID:15856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4557.exe
        5⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16167.exe
        6⤵
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61247.exe
        7⤵
        
        PID:12028
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 744
        7⤵
        Program crash
        
        PID:15176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60074.exe
        6⤵
        
        PID:11260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59829.exe
        6⤵
        
        PID:14936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62176.exe
        6⤵
        
        PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54657.exe
        5⤵
        
        PID:8376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54828.exe
        6⤵
        
        PID:15228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63986.exe
        5⤵
        
        PID:11912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48846.exe
        5⤵
        
        PID:5008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8773.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27783.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63335.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25435.exe
        7⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40479.exe
        8⤵
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56151.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63676.exe
        9⤵
        
        PID:17448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63774.exe
        8⤵
        
        PID:10428
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10428 -s 220
        9⤵
        Program crash
        
        PID:12252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        8⤵
        
        PID:14432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59482.exe
        7⤵
        
        PID:8884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14786.exe
        8⤵
        
        PID:12628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1543.exe
        8⤵
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10192.exe
        7⤵
        
        PID:12392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34164.exe
        7⤵
        
        PID:15476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37753.exe
        6⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
        7⤵
        
        PID:8588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22815.exe
        8⤵
        
        PID:13088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48196.exe
        8⤵
        
        PID:16796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37428.exe
        7⤵
        
        PID:14212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9067.exe
        7⤵
        
        PID:17428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62825.exe
        7⤵
        
        PID:11892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38050.exe
        6⤵
        
        PID:8936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29156.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16939.exe
        6⤵
        
        PID:16780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63890.exe
        5⤵
        Executes dropped EXE
        
        PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30596.exe
        5⤵
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21299.exe
        6⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8242.exe
        7⤵
        
        PID:10140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25602.exe
        7⤵
        
        PID:468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33507.exe
        7⤵
        
        PID:9408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49830.exe
        6⤵
        
        PID:9980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21728.exe
        6⤵
        
        PID:12964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41835.exe
        6⤵
        
        PID:17612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11049.exe
        5⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10702.exe
        6⤵
        
        PID:12308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54828.exe
        6⤵
        
        PID:15300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37376.exe
        5⤵
        
        PID:10544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49765.exe
        5⤵
        
        PID:15760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37989.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59251.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        6⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63255.exe
        7⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27039.exe
        8⤵
        
        PID:10916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3026.exe
        9⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3026.exe
        8⤵
        
        PID:14680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59114.exe
        7⤵
        
        PID:10672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43877.exe
        7⤵
        
        PID:14488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-723.exe
        7⤵
        
        PID:14764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49778.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34983.exe
        7⤵
        
        PID:15492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61941.exe
        6⤵
        
        PID:11000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16562.exe
        6⤵
        
        PID:8052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25797.exe
        5⤵
        
        PID:5900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2954.exe
        6⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22955.exe
        7⤵
        
        PID:11544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50540.exe
        7⤵
        
        PID:8908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38205.exe
        6⤵
        
        PID:11976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34.exe
        6⤵
        
        PID:15812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48329.exe
        5⤵
        
        PID:8104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46935.exe
        6⤵
        
        PID:12996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31859.exe
        6⤵
        
        PID:17728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4844.exe
        5⤵
        
        PID:12380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22175.exe
        5⤵
        
        PID:17720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9785.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25435.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31735.exe
        6⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22955.exe
        7⤵
        
        PID:11608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41703.exe
        7⤵
        
        PID:17880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23509.exe
        6⤵
        
        PID:10944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        6⤵
        
        PID:15404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38869.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54828.exe
        6⤵
        
        PID:3336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16824.exe
        5⤵
        
        PID:11364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6504.exe
        5⤵
        
        PID:9024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28564.exe
      4⤵
      PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51003.exe
        5⤵
        
        PID:7148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20495.exe
        6⤵
        
        PID:9968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7993.exe
        6⤵
        
        PID:9448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29888.exe
        6⤵
        
        PID:16688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59114.exe
        5⤵
        
        PID:10656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43877.exe
        5⤵
        
        PID:14452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62176.exe
        5⤵
        
        PID:2208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15589.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22955.exe
        5⤵
        
        PID:11424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11029.exe
        5⤵
        
        PID:14688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57847.exe
        5⤵
        
        PID:17660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59671.exe
      4⤵
      PID:10896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24243.exe
      4⤵
      PID:16036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29821.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29821.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12302.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34991.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8514.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35131.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20967.exe
        8⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24335.exe
        9⤵
        
        PID:7376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24941.exe
        9⤵
        
        PID:10060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10204.exe
        9⤵
        
        PID:9036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10857.exe
        8⤵
        
        PID:8504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21771.exe
        9⤵
        
        PID:15544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14469.exe
        8⤵
        
        PID:13584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12390.exe
        8⤵
        
        PID:17700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58470.exe
        7⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15398.exe
        8⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24387.exe
        9⤵
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12390.exe
        9⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26441.exe
        8⤵
        
        PID:10556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47703.exe
        9⤵
        
        PID:10320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27967.exe
        9⤵
        
        PID:17760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43877.exe
        8⤵
        
        PID:14460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        8⤵
        
        PID:13644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51261.exe
        7⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59638.exe
        7⤵
        
        PID:11300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-987.exe
        7⤵
        
        PID:15568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27517.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59067.exe
        7⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34401.exe
        8⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30420.exe
        8⤵
        
        PID:11824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51347.exe
        8⤵
        
        PID:16828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42429.exe
        7⤵
        
        PID:9460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52280.exe
        8⤵
        
        PID:19040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14853.exe
        7⤵
        
        PID:13404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38711.exe
        7⤵
        
        PID:19016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40493.exe
        6⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64407.exe
        7⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42575.exe
        8⤵
        
        PID:14820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5829.exe
        7⤵
        
        PID:10692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8891.exe
        7⤵
        
        PID:15244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29690.exe
        6⤵
        
        PID:7972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52317.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49869.exe
        6⤵
        
        PID:19416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54186.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38049.exe
        6⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63255.exe
        7⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53167.exe
        8⤵
        
        PID:10080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7993.exe
        8⤵
        
        PID:14160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3026.exe
        8⤵
        
        PID:652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59114.exe
        7⤵
        
        PID:10680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8891.exe
        7⤵
        
        PID:2836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59429.exe
        6⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47703.exe
        7⤵
        
        PID:13236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38795.exe
        7⤵
        
        PID:19796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26966.exe
        6⤵
        
        PID:9572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29383.exe
        6⤵
        
        PID:15748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45337.exe
        5⤵
        Executes dropped EXE
        
        PID:2100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46815.exe
        6⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39903.exe
        7⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4158.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7993.exe
        8⤵
        
        PID:14188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46416.exe
        8⤵
        
        PID:15536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5829.exe
        7⤵
        
        PID:10708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43877.exe
        7⤵
        
        PID:14480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        7⤵
        
        PID:15428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34593.exe
        6⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55617.exe
        7⤵
        
        PID:17648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16824.exe
        6⤵
        
        PID:11352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21606.exe
        6⤵
        
        PID:15160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47510.exe
        5⤵
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57199.exe
        6⤵
        
        PID:7500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65227.exe
        7⤵
        
        PID:8976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33588.exe
        7⤵
        
        PID:14556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23509.exe
        6⤵
        
        PID:10952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8891.exe
        6⤵
        
        PID:1708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50573.exe
        5⤵
        
        PID:8328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60277.exe
        6⤵
        
        PID:17676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63986.exe
        5⤵
        
        PID:11920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40486.exe
        5⤵
        
        PID:15952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19017.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8322.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59635.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38455.exe
        7⤵
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40479.exe
        8⤵
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39461.exe
        8⤵
        
        PID:10336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59829.exe
        8⤵
        
        PID:14920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62176.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35169.exe
        7⤵
        
        PID:8608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32903.exe
        8⤵
        
        PID:11620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42575.exe
        8⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51609.exe
        7⤵
        
        PID:12264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33396.exe
        7⤵
        
        PID:15616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27909.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40479.exe
        7⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53515.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1543.exe
        8⤵
        
        PID:14696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63774.exe
        7⤵
        
        PID:10472
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10472 -s 220
        8⤵
        Program crash
        
        PID:10308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8891.exe
        7⤵
        
        PID:1192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48905.exe
        6⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42575.exe
        7⤵
        
        PID:2864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49306.exe
        6⤵
        
        PID:12184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41067.exe
        6⤵
        
        PID:15800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24837.exe
        5⤵
        
        PID:944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46623.exe
        6⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47879.exe
        7⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49851.exe
        8⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47376.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:19344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22165.exe
        7⤵
        
        PID:10772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8891.exe
        7⤵
        
        PID:14568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30509.exe
        6⤵
        
        PID:8036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39975.exe
        7⤵
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17593.exe
        6⤵
        
        PID:13168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25602.exe
        6⤵
        
        PID:17436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53705.exe
        5⤵
        
        PID:6120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56047.exe
        6⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63115.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51347.exe
        7⤵
        
        PID:17112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-629.exe
        6⤵
        
        PID:9552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13630.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49726.exe
        5⤵
        
        PID:8228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56209.exe
        5⤵
        
        PID:11764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22136.exe
        5⤵
        
        PID:15904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26696.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44703.exe
        5⤵
        
        PID:4064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46623.exe
        6⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42569.exe
        7⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22252.exe
        7⤵
        
        PID:11780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49339.exe
        7⤵
        
        PID:19404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54681.exe
        6⤵
        
        PID:9420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54828.exe
        7⤵
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14853.exe
        6⤵
        
        PID:13384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47071.exe
        6⤵
        
        PID:17004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39969.exe
        5⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28803.exe
        6⤵
        
        PID:6920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56566.exe
        6⤵
        
        PID:10620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54584.exe
        6⤵
        
        PID:14788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49638.exe
        5⤵
        
        PID:10120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11580.exe
        5⤵
        
        PID:13272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25261.exe
        5⤵
        
        PID:15692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11573.exe
      4⤵
      PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58683.exe
        5⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1204.exe
        6⤵
        
        PID:9584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63862.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4030.exe
        6⤵
        
        PID:16896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30125.exe
        5⤵
        
        PID:8236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59009.exe
        5⤵
        
        PID:11772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12478.exe
        5⤵
        
        PID:216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42737.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31927.exe
        5⤵
        
        PID:7936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63956.exe
        6⤵
        
        PID:15620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48590.exe
        5⤵
        
        PID:10788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34164.exe
        5⤵
        
        PID:15484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53882.exe
      4⤵
      PID:8872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47703.exe
        5⤵
        
        PID:11660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56364.exe
        5⤵
        
        PID:18972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20366.exe
      4⤵
      PID:11720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44762.exe
      4⤵
      PID:15924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22508.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22508.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23699.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10242.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1122.exe
        6⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8854.exe
        7⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20495.exe
        8⤵
        
        PID:9640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7993.exe
        8⤵
        
        PID:13804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45840.exe
        8⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7453.exe
        7⤵
        
        PID:9748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46495.exe
        7⤵
        
        PID:15716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61070.exe
        6⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe
        7⤵
        
        PID:9672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7993.exe
        7⤵
        
        PID:14192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13551.exe
        7⤵
        
        PID:16668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40177.exe
        6⤵
        
        PID:10580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-226.exe
        6⤵
        
        PID:2556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37753.exe
        5⤵
        
        PID:6624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-126.exe
        6⤵
        
        PID:9912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14786.exe
        7⤵
        
        PID:12644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1543.exe
        7⤵
        
        PID:15124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21921.exe
        6⤵
        
        PID:12968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52803.exe
        6⤵
        
        PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32124.exe
        5⤵
        
        PID:9052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58418.exe
        5⤵
        
        PID:12280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32510.exe
        5⤵
        
        PID:1828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31217.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8906.exe
        5⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14054.exe
        6⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13790.exe
        7⤵
        
        PID:15212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6587.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59114.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        6⤵
        
        PID:15388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37525.exe
        5⤵
        
        PID:7560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61941.exe
        5⤵
        
        PID:11220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28814.exe
        5⤵
        
        PID:15520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27280.exe
      4⤵
      PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14054.exe
        5⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe
        6⤵
        
        PID:9664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7993.exe
        6⤵
        
        PID:10308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33204.exe
        6⤵
        
        PID:15752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59114.exe
        5⤵
        
        PID:8408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59829.exe
        5⤵
        
        PID:14944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        5⤵
        
        PID:14708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61210.exe
      4⤵
      PID:7632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59141.exe
      4⤵
      PID:10864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51877.exe
      4⤵
      PID:18980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39770.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39770.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54015.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12606.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-686.exe
        6⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1942.exe
        7⤵
        
        PID:8536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21035.exe
        8⤵
        
        PID:14804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54828.exe
        8⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8604.exe
        7⤵
        
        PID:13568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32805.exe
        8⤵
        
        PID:17896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6535.exe
        7⤵
        
        PID:17060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28693.exe
        6⤵
        
        PID:9440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45937.exe
        6⤵
        
        PID:13220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42531.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36373.exe
        5⤵
        
        PID:1128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52237.exe
        5⤵
        
        PID:10848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64708.exe
        5⤵
        
        PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17053.exe
      4⤵
      PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52435.exe
        5⤵
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63587.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8604.exe
        6⤵
        
        PID:13560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4222.exe
        6⤵
        
        PID:19396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64526.exe
        5⤵
        
        PID:7408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43365.exe
        6⤵
        
        PID:17296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56234.exe
        5⤵
        
        PID:13980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25602.exe
        5⤵
        
        PID:17456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51349.exe
      4⤵
      PID:6748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57007.exe
        5⤵
        
        PID:7436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36743.exe
        6⤵
        
        PID:11496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11029.exe
        6⤵
        
        PID:14668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28402.exe
        6⤵
        
        PID:17476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23509.exe
        5⤵
        
        PID:10960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15096.exe
        5⤵
        
        PID:14672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8891.exe
        5⤵
        
        PID:4468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54194.exe
      4⤵
      PID:8112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57930.exe
      4⤵
      PID:12860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50725.exe
      4⤵
      PID:16336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49169.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49169.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45279.exe
      4⤵
      PID:5156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44075.exe
        5⤵
        
        PID:6504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29653.exe
        6⤵
        
        PID:9700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49909.exe
        7⤵
        
        PID:2724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46286.exe
        6⤵
        
        PID:13292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14711.exe
        6⤵
        
        PID:9088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43773.exe
        5⤵
        
        PID:10128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20245.exe
        5⤵
        
        PID:13260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26650.exe
        5⤵
        
        PID:17096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33337.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe
        5⤵
        
        PID:9656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7993.exe
        5⤵
        
        PID:13372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35316.exe
        5⤵
        
        PID:16972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19652.exe
      4⤵
      PID:8004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3525.exe
      4⤵
      PID:13792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16236.exe
      4⤵
      PID:1592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61614.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61614.exe
    3⤵
    PID:5424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27355.exe
      4⤵
      PID:6700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11241.exe
        5⤵
        
        PID:8580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23370.exe
        5⤵
        
        PID:14180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42795.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:19320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31853.exe
      4⤵
      PID:9176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44017.exe
      4⤵
      PID:12724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8891.exe
      4⤵
      PID:2852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40911.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40911.exe
    3⤵
    PID:6784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29653.exe
      4⤵
      PID:9692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17696.exe
      4⤵
      PID:13888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55928.exe
      4⤵
      PID:16788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42208.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42208.exe
    3⤵
    PID:7640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59125.exe
      4⤵
      PID:16360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14881.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14881.exe
    3⤵
    PID:12780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64048.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64048.exe
    3⤵
    PID:15644
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35913.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35913.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49687.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49687.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12302.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14305.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64931.exe
        6⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42155.exe
        7⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9897.exe
        8⤵
        
        PID:8188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47703.exe
        9⤵
        
        PID:13280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60395.exe
        9⤵
        
        PID:15468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
        8⤵
        
        PID:11880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26380.exe
        8⤵
        
        PID:15824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29792.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56618.exe
        7⤵
        
        PID:13732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26650.exe
        7⤵
        
        PID:16988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52222.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38485.exe
        7⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27423.exe
        8⤵
        
        PID:10312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31806.exe
        8⤵
        
        PID:14448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13509.exe
        7⤵
        
        PID:12980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6230.exe
        7⤵
        
        PID:16916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23824.exe
        6⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40635.exe
        7⤵
        
        PID:12000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14371.exe
        7⤵
        
        PID:16704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60982.exe
        6⤵
        
        PID:11804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34811.exe
        6⤵
        
        PID:17744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13492.exe
        5⤵
        
        PID:3424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30863.exe
        6⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27651.exe
        7⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58995.exe
        8⤵
        
        PID:13608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1543.exe
        8⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23509.exe
        7⤵
        
        PID:10968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8891.exe
        7⤵
        
        PID:15196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9705.exe
        6⤵
        
        PID:8204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39643.exe
        7⤵
        
        PID:16000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1640.exe
        6⤵
        
        PID:11788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37174.exe
        6⤵
        
        PID:15872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32518.exe
        5⤵
        
        PID:6868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3826.exe
        6⤵
        
        PID:10048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57054.exe
        6⤵
        
        PID:14008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28402.exe
        6⤵
        
        PID:17492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29296.exe
        5⤵
        
        PID:7668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35693.exe
        5⤵
        
        PID:13688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40678.exe
        5⤵
        
        PID:15888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20169.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8898.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45279.exe
        6⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25383.exe
        7⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18767.exe
        8⤵
        
        PID:8788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58782.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37480.exe
        8⤵
        
        PID:15460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16440.exe
        7⤵
        
        PID:11224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-157.exe
        7⤵
        
        PID:14896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61679.exe
        7⤵
        
        PID:15908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61070.exe
        6⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
        7⤵
        
        PID:10112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50500.exe
        7⤵
        
        PID:16740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40177.exe
        6⤵
        
        PID:10524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20646.exe
        6⤵
        
        PID:15724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5569.exe
        5⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57199.exe
        6⤵
        
        PID:7308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8050.exe
        7⤵
        
        PID:9828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7993.exe
        7⤵
        
        PID:13452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50500.exe
        7⤵
        
        PID:17104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60074.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59829.exe
        6⤵
        
        PID:14884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45840.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53373.exe
        5⤵
        
        PID:8320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22955.exe
        6⤵
        
        PID:11552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41511.exe
        6⤵
        
        PID:19008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20525.exe
        5⤵
        
        PID:12240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-226.exe
        5⤵
        
        PID:14412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49229.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1122.exe
        5⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21299.exe
        6⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61527.exe
        7⤵
        
        PID:8632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7993.exe
        7⤵
        
        PID:12804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42140.exe
        7⤵
        
        PID:16800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8413.exe
        6⤵
        
        PID:8712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9092.exe
        6⤵
        
        PID:12204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31246.exe
        6⤵
        
        PID:7548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61070.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58839.exe
        6⤵
        
        PID:9196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21414.exe
        6⤵
        
        PID:4980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43145.exe
        5⤵
        
        PID:9800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20639.exe
        5⤵
        
        PID:14580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37230.exe
      4⤵
      PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24335.exe
        5⤵
        
        PID:7356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61645.exe
        5⤵
        
        PID:8816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39643.exe
        6⤵
        
        PID:15992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12845.exe
        5⤵
        
        PID:12816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12390.exe
        5⤵
        
        PID:16424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17708.exe
      4⤵
      PID:8484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22955.exe
        5⤵
        
        PID:11684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64479.exe
        5⤵
        
        PID:15896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60862.exe
      4⤵
      PID:12256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21176.exe
      4⤵
      PID:15632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8773.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63195.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13558.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27791.exe
        6⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30863.exe
        7⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15398.exe
        8⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54828.exe
        9⤵
        
        PID:2652
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 436
        10⤵
        Program crash
        
        PID:8904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7173.exe
        8⤵
        
        PID:10904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8891.exe
        8⤵
        
        PID:1184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62030.exe
        7⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58995.exe
        8⤵
        
        PID:12232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40411.exe
        8⤵
        
        PID:16816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16824.exe
        7⤵
        
        PID:11380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26650.exe
        7⤵
        
        PID:17076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33337.exe
        6⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe
        7⤵
        
        PID:9900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42524.exe
        7⤵
        
        PID:15700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27822.exe
        6⤵
        
        PID:9388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6292.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-564.exe
        6⤵
        
        PID:15840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48766.exe
        5⤵
        
        PID:4416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27355.exe
        6⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2134.exe
        7⤵
        
        PID:8296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40997.exe
        7⤵
        
        PID:11752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        7⤵
        
        PID:3576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35937.exe
        6⤵
        
        PID:9208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44017.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15706.exe
        6⤵
        
        PID:16044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47265.exe
        5⤵
        
        PID:6816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49223.exe
        6⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31803.exe
        7⤵
        
        PID:14196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19362.exe
        7⤵
        
        PID:15572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15533.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12983.exe
        6⤵
        
        PID:8432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6337.exe
        5⤵
        
        PID:7980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41217.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28615.exe
        5⤵
        
        PID:15600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44127.exe
        5⤵
        
        PID:4592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52435.exe
        6⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59503.exe
        7⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13795.exe
        8⤵
        
        PID:15680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8604.exe
        7⤵
        
        PID:13576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6343.exe
        7⤵
        
        PID:19352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52274.exe
        6⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57163.exe
        7⤵
        
        PID:12064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5627.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44017.exe
        6⤵
        
        PID:12752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8891.exe
        6⤵
        
        PID:7040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53950.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24719.exe
        6⤵
        
        PID:6412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56566.exe
        6⤵
        
        PID:10824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47568.exe
        6⤵
        
        PID:16760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53338.exe
        5⤵
        
        PID:9724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31113.exe
        6⤵
        
        PID:17268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51653.exe
        5⤵
        
        PID:13948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46679.exe
        5⤵
        
        PID:18988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62501.exe
      4⤵
      PID:4880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11210.exe
        5⤵
        
        PID:6592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43930.exe
        6⤵
        
        PID:10988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35517.exe
        6⤵
        
        PID:14704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62176.exe
        6⤵
        
        PID:14960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59778.exe
        5⤵
        
        PID:10228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12279.exe
        5⤵
        
        PID:15528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61298.exe
      4⤵
      PID:6764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1942.exe
        5⤵
        
        PID:8528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14786.exe
        6⤵
        
        PID:12608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54828.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37873.exe
        5⤵
        
        PID:12652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52035.exe
        5⤵
        
        PID:15608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14008.exe
      4⤵
      PID:4768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49185.exe
      4⤵
      PID:12832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62017.exe
      4⤵
      PID:15776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21652.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21652.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22687.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61615.exe
        5⤵
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35523.exe
        6⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe
        7⤵
        
        PID:9924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39643.exe
        8⤵
        
        PID:16008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38056.exe
        7⤵
        
        PID:16468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38973.exe
        6⤵
        
        PID:8224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6020.exe
        6⤵
        
        PID:13432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4414.exe
        6⤵
        
        PID:19312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9409.exe
        5⤵
        
        PID:6248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12378.exe
        6⤵
        
        PID:9892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44802.exe
        6⤵
        
        PID:13964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28402.exe
        6⤵
        
        PID:17484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8552.exe
        5⤵
        
        PID:8944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12845.exe
        5⤵
        
        PID:13956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20770.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1485.exe
      4⤵
      PID:5492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55087.exe
        5⤵
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36447.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60894.exe
        6⤵
        
        PID:11620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25434.exe
        6⤵
        
        PID:8272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26441.exe
        5⤵
        
        PID:10508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        5⤵
        
        PID:3120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51261.exe
      4⤵
      PID:8048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64231.exe
        5⤵
        
        PID:2148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1543.exe
        5⤵
        
        PID:4952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36670.exe
      4⤵
      PID:11292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24730.exe
      4⤵
      PID:15664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55094.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55094.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32451.exe
      4⤵
      PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9970.exe
        5⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39483.exe
        6⤵
        
        PID:11284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32190.exe
        6⤵
        
        PID:16516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59114.exe
        5⤵
        
        PID:10664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        5⤵
        
        PID:13652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57946.exe
      4⤵
      PID:7760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20553.exe
        5⤵
        
        PID:17904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16824.exe
      4⤵
      PID:11372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45343.exe
      4⤵
      PID:14456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14333.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14333.exe
    3⤵
    PID:6608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2134.exe
      4⤵
      PID:8288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39067.exe
        5⤵
        
        PID:16724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29513.exe
      4⤵
      PID:10328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3026.exe
      4⤵
      PID:4800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43319.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43319.exe
    3⤵
    PID:9188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36411.exe
      4⤵
      PID:14416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1543.exe
      4⤵
      PID:14668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20216.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20216.exe
    3⤵
    PID:12732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63932.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63932.exe
    3⤵
    PID:15552
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35389.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35389.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36807.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36807.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6018.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65499.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11838.exe
        6⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38071.exe
        7⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31927.exe
        8⤵
        
        PID:7928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe
        9⤵
        
        PID:10000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7993.exe
        9⤵
        
        PID:12852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38056.exe
        9⤵
        
        PID:16480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56182.exe
        8⤵
        
        PID:11004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60021.exe
        8⤵
        
        PID:14768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        8⤵
        
        PID:15364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63233.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43365.exe
        8⤵
        
        PID:16124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63612.exe
        8⤵
        
        PID:20052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11117.exe
        7⤵
        
        PID:14016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32716.exe
        7⤵
        
        PID:14728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49227.exe
        7⤵
        
        PID:15916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57266.exe
        6⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61283.exe
        7⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14786.exe
        8⤵
        
        PID:12660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50744.exe
        8⤵
        
        PID:15380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60074.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59829.exe
        7⤵
        
        PID:14876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        7⤵
        
        PID:13660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57457.exe
        6⤵
        
        PID:8380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5804.exe
        6⤵
        
        PID:13596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30727.exe
        6⤵
        
        PID:17780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16477.exe
        5⤵
        
        PID:3856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42155.exe
        6⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27459.exe
        7⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16411.exe
        8⤵
        
        PID:9744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38056.exe
        8⤵
        
        PID:16532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5829.exe
        7⤵
        
        PID:11076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39409.exe
        7⤵
        
        PID:14828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21055.exe
        7⤵
        
        PID:2496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54681.exe
        6⤵
        
        PID:9392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1543.exe
        7⤵
        
        PID:14688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51802.exe
        6⤵
        
        PID:13252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46879.exe
        6⤵
        
        PID:19368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53513.exe
        5⤵
        
        PID:5276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56047.exe
        6⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1543.exe
        7⤵
        
        PID:6204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5829.exe
        6⤵
        
        PID:10700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        6⤵
        
        PID:15372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29690.exe
        5⤵
        
        PID:7964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53846.exe
        5⤵
        
        PID:12876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25837.exe
        5⤵
        
        PID:16712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6137.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19623.exe
        5⤵
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30863.exe
        6⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47703.exe
        8⤵
        
        PID:14040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44112.exe
        8⤵
        
        PID:17800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3089.exe
        7⤵
        
        PID:11344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35316.exe
        7⤵
        
        PID:17084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52082.exe
        6⤵
        
        PID:8700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18861.exe
        7⤵
        
        PID:17308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17379.exe
        7⤵
        
        PID:20024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41085.exe
        6⤵
        
        PID:13092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22296.exe
        6⤵
        
        PID:15808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61017.exe
        5⤵
        
        PID:6620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12134.exe
        6⤵
        
        PID:2320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60894.exe
        6⤵
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17635.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12061.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18928.exe
        5⤵
        
        PID:12976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39241.exe
        5⤵
        
        PID:17736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29828.exe
      4⤵
      PID:2932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44075.exe
        5⤵
        
        PID:6496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4106.exe
        6⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36743.exe
        7⤵
        
        PID:11524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45595.exe
        7⤵
        
        PID:19000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48206.exe
        6⤵
        
        PID:10932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51460.exe
        6⤵
        
        PID:1736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23493.exe
        5⤵
        
        PID:8284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35657.exe
        5⤵
        
        PID:12988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36602.exe
      4⤵
      PID:6884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57303.exe
        5⤵
        
        PID:9940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57054.exe
        5⤵
        
        PID:14044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53763.exe
        5⤵
        
        PID:19048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31401.exe
      4⤵
      PID:8000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-315.exe
      4⤵
      PID:17668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22909.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22909.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26003.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44511.exe
        5⤵
        
        PID:3752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42155.exe
        6⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15398.exe
        7⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33043.exe
        8⤵
        
        PID:11432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38299.exe
        8⤵
        
        PID:15740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26441.exe
        7⤵
        
        PID:10536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62176.exe
        7⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8448.exe
        6⤵
        
        PID:8856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1543.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34698.exe
        6⤵
        
        PID:13076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50003.exe
        6⤵
        
        PID:15672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10997.exe
        5⤵
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15398.exe
        6⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54147.exe
        7⤵
        
        PID:19056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26441.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23456.exe
        6⤵
        
        PID:14428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        6⤵
        
        PID:10020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30648.exe
        5⤵
        
        PID:7800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50765.exe
        6⤵
        
        PID:16448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14521.exe
        5⤵
        
        PID:11452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34427.exe
        5⤵
        
        PID:17712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65294.exe
      4⤵
      PID:1584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18995.exe
        5⤵
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40479.exe
        6⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe
        7⤵
        
        PID:10200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41756.exe
        7⤵
        
        PID:14784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56182.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60021.exe
        6⤵
        
        PID:14776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        6⤵
        
        PID:15412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35169.exe
        5⤵
        
        PID:8600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27719.exe
        6⤵
        
        PID:14144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40027.exe
        6⤵
        
        PID:17584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43249.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29312.exe
        5⤵
        
        PID:15656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24732.exe
      4⤵
      PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24335.exe
        5⤵
        
        PID:7524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57858.exe
        5⤵
        
        PID:9972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47703.exe
        6⤵
        
        PID:13908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3026.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5252.exe
        5⤵
        
        PID:13992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34268.exe
        5⤵
        
        PID:17420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26374.exe
      4⤵
      PID:8476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54828.exe
        5⤵
        
        PID:2636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40641.exe
      4⤵
      PID:12272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8195.exe
      4⤵
      PID:15588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32124.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32124.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27791.exe
      4⤵
      PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2274.exe
        5⤵
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36307.exe
        6⤵
        
        PID:9452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60790.exe
        6⤵
        
        PID:13392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50063.exe
        6⤵
        
        PID:16764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34121.exe
        5⤵
        
        PID:10148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14380.exe
        5⤵
        
        PID:13240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33602.exe
        5⤵
        
        PID:6460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33337.exe
      4⤵
      PID:6932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe
        5⤵
        
        PID:9956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58292.exe
        5⤵
        
        PID:7788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19652.exe
      4⤵
      PID:8012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3525.exe
      4⤵
      PID:13824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50963.exe
      4⤵
      PID:19448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43862.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43862.exe
    3⤵
    PID:2304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30863.exe
      4⤵
      PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe
        5⤵
        
        PID:9676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8398.exe
        6⤵
        
        PID:15084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1543.exe
        6⤵
        
        PID:14840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7993.exe
        5⤵
        
        PID:14176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60012.exe
        5⤵
        
        PID:17604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62295.exe
        5⤵
        
        PID:20060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5341.exe
      4⤵
      PID:10168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51137.exe
      4⤵
      PID:13556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47376.exe
      4⤵
      PID:19328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22508.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22508.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
      4⤵
      PID:9888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3000.exe
      4⤵
      PID:15296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59628.exe
      4⤵
      PID:19360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33373.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33373.exe
    3⤵
    PID:8492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3750.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3750.exe
    3⤵
    PID:13364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4602.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4602.exe
    3⤵
    PID:16680
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52878.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52878.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19615.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19615.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22495.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25435.exe
        5⤵
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24335.exe
        6⤵
        
        PID:7532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19425.exe
        6⤵
        
        PID:10884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        6⤵
        
        PID:14484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6773.exe
        5⤵
        
        PID:8464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47703.exe
        6⤵
        
        PID:13416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23691.exe
        6⤵
        
        PID:17620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14469.exe
        5⤵
        
        PID:13612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37942.exe
        5⤵
        
        PID:16352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37753.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49223.exe
        5⤵
        
        PID:7452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14786.exe
        6⤵
        
        PID:12620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50744.exe
        6⤵
        
        PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15533.exe
        5⤵
        
        PID:10496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26188.exe
        5⤵
        
        PID:2484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18589.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-184.exe
      4⤵
      PID:12844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51278.exe
      4⤵
      PID:9076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31217.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31217.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12990.exe
      4⤵
      PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24335.exe
        5⤵
        
        PID:7368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59114.exe
        5⤵
        
        PID:10640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        5⤵
        
        PID:14656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6773.exe
      4⤵
      PID:8456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45731.exe
        5⤵
        
        PID:14748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62996.exe
        5⤵
        
        PID:4360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43441.exe
      4⤵
      PID:11268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10243.exe
      4⤵
      PID:8028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35450.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35450.exe
    3⤵
    PID:6660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49223.exe
      4⤵
      PID:7396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48803.exe
        5⤵
        
        PID:12316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1543.exe
        5⤵
        
        PID:3732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56566.exe
      4⤵
      PID:11400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34164.exe
      4⤵
      PID:16436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42789.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42789.exe
    3⤵
    PID:9164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24681.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24681.exe
    3⤵
    PID:12796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62209.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62209.exe
    3⤵
    PID:15864
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31104.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31104.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63335.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63335.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12990.exe
      4⤵
      PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23567.exe
        5⤵
        
        PID:6280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33515.exe
        6⤵
        
        PID:9756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7154.exe
        6⤵
        
        PID:19436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60074.exe
        5⤵
        
        PID:11244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59829.exe
        5⤵
        
        PID:14912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8891.exe
        5⤵
        
        PID:756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10089.exe
      4⤵
      PID:8020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46286.exe
        5⤵
        
        PID:14760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
        5⤵
        
        PID:14384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13509.exe
      4⤵
      PID:12412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1954.exe
      4⤵
      PID:19376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13545.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13545.exe
    3⤵
    PID:5820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31927.exe
      4⤵
      PID:7892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59031.exe
        5⤵
        
        PID:7648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57822.exe
        5⤵
        
        PID:13540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62176.exe
        5⤵
        
        PID:3184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20716.exe
      4⤵
      PID:11040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-226.exe
      4⤵
      PID:1036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7680.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7680.exe
    3⤵
    PID:8896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2285.exe
      4⤵
      PID:15036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3026.exe
      4⤵
      PID:704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23448.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23448.exe
    3⤵
    PID:13692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30343.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30343.exe
    3⤵
    PID:17592
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50122.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50122.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8906.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8906.exe
    3⤵
    PID:5684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15398.exe
      4⤵
      PID:2272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe
        5⤵
        
        PID:10056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37288.exe
        5⤵
        
        PID:15784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26441.exe
      4⤵
      PID:10564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8891.exe
      4⤵
      PID:14500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4329.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4329.exe
    3⤵
    PID:10204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48337.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48337.exe
    3⤵
    PID:12296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30535.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30535.exe
    3⤵
    PID:17036
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25011.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25011.exe
  2⤵
  PID:5832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31927.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31927.exe
    3⤵
    PID:7948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14786.exe
      4⤵
      PID:12636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50744.exe
      4⤵
      PID:7300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63774.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63774.exe
    3⤵
    PID:10456
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 10456 -s 220
      4⤵
      Program crash
      PID:12224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
    3⤵
    PID:15420
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49416.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49416.exe
  2⤵
  PID:8864
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59037.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59037.exe
  2⤵
  PID:10860
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31372.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31372.exe
  2⤵
  PID:17888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 10472 -ip 10472
1⤵
PID:10724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 9884 -ip 9884
1⤵
PID:11108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 10456 -ip 10456
1⤵
PID:11392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 10428 -ip 10428
1⤵
PID:11656

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12302.exe

Filesize
468KB

MD5
189ac6ff26b6933cfe50314a0a77cadf

SHA1
9d88c744e7b2a06735d887291af250e56d973fcf

SHA256
46483ba8ede187bcc68116052b5a9510cbaf19284b48487c84d54279c1ffc5c4

SHA512
03598dd66d7d25741b7c83994c30d7c9fc8a797b4b03ac05f779ad1506c1e617c99875d38f0d62dcb2867996af95f0f1e46b6d9d6cc9e2d1e49177f8a506133e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19017.exe

Filesize
468KB

MD5
c362223f20d28ecb14b638aa20a2de55

SHA1
c51c8585ca485c8b0da3cf8396e413a556b8e013

SHA256
c221672323b2623acd878be428a55c8b9e2c3dc6ccce2906adfa01547bcb6b8b

SHA512
bf4b6d70cb0a850814d1d2ca82f9142292dc39da4a9dc5858f3abb3c05fbb92206bdfabc25c1ecccd464724e1b6f1d414bbb54ffa77469337027fe10fbe062a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19615.exe

Filesize
468KB

MD5
08e132c9716a9629977c1707a9c3c687

SHA1
de7e437298140b927a6822ec8a82d34ad7812303

SHA256
8ef48d5fa522e6bae489fa191d6028fc5c11275af2e602a316198ce76e22788c

SHA512
f03c5984da6b0c6190bfc99c51cb936ddca79bbc6c3e508af9f1bbe4fe1f2675cc06a6ffa48fcff10732abb12b0fb4147eb6fb89c54793ef29558916c6aa1ec7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20169.exe

Filesize
468KB

MD5
1244ff49f40531fc9ba75b73f1fbaf36

SHA1
93d474169c01b64492f440ff5754fa27835ac23f

SHA256
fb6113bb5d6618a662ad422eaf5a86b3aaa7963757f928e600d746e45ca177c2

SHA512
082c035ca3028266972a54a951b504444622c79268db7c602a6d98e88d4147a97d3dc8fb1051fb265daab424bf07e5557afd2ca6711a00c0fefb936accd26457

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21652.exe

Filesize
468KB

MD5
e6e309c12e9fa4d240d0279cac8b37ca

SHA1
6fc2e612b3648670abcf9e7571d520cbdfe10101

SHA256
fa59546d511af7ef3953b0982e420b301f5fa7d286971bc73bfcf5767a2ddb20

SHA512
701bfb1eca0904e31f07e4b857ed56a48aeb9ff76f7c5bc013a980922378f937d4c07d99a0a388776bda5c472834f5b32a4ad742953e3530c8cc85702cb8e651

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22495.exe

Filesize
468KB

MD5
ac1fab871167752f367a32cbafcaea86

SHA1
cec0b77418d529825e5fbfe56a797b4e4c539c7e

SHA256
ff084dd1eecc3a601ba00f1c21991ec222fd4d457521ca1ec21310d8823515c6

SHA512
1c1282667e5b2111ac6e8a2af86674aff302dfa4eef038f8647ea68ceb5916e6ac592477c85baa76f04cadb09230d6af01de45e9c012e382b1eb76bf69eda46a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22508.exe

Filesize
468KB

MD5
9506e50293f5db1c4b2bc625b0caf5a2

SHA1
409c72927e5efbfbf845d3a0bc94963a9b43ddb3

SHA256
086fe263c882a52fe11dd3e70bb89d0f6d3dba5873c1fbd754c3a1e3b2039971

SHA512
19c05ab3623cd7679869878edcaf2ba56d9af7938c96f8b8b3d2ff7a03916727386cf83792444f83ad3ffbff0dc5b709f107a221f624976c59f0b86f3f28ca27

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22909.exe

Filesize
468KB

MD5
7d54ea69a6964d57be137090654c8405

SHA1
fc1b21d8bae58406bf8614b39539d16b97489ae0

SHA256
6d57754b3770abdff89ad520b8c2b01bd0c55dd3293ecbe87022be920108676b

SHA512
16fe523cbb5093f5555a3cb6e38116b72bdbe2398b4407d35dc14779229be4f45af7196221d04104f91a8cf657de53e821f538d010c544810acf8f8e15113306

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23699.exe

Filesize
468KB

MD5
c5b51beabf1abd1096143e585b24e017

SHA1
989557dbbc0b7d0a08efcb4f186ee68d58ea5468

SHA256
35c4f56ec1eba29a29269ba8c3b3c923d45cba0ab3d97efed2fa8c3d175bdab5

SHA512
6e64eaf9958736905b49cb405a2f127cef79345f9b431cf15bacdcf0e6b941039ab34698c8ffa27e859b2b8376f8fd2eeb2824cdcb860b4917b9cb503a9f25d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24253.exe

Filesize
468KB

MD5
a3631bffabfc50d218eee66e24e421de

SHA1
7072bf7936c97853f338decf86c6e6a18fcef635

SHA256
c97b0599cace28191404e705a82481b2f794f60bef525bb8f4bcae3a333d18a1

SHA512
d48904f7e001d8b09a9fac4a4810f4f218ff1df593da16ff507cf0ae8dc999d41c92aab3b710d168a82cf3f1ce4857e5aced0824729c7f805d94855d9a15d312

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24887.exe

Filesize
468KB

MD5
1db079b144fc2be80f4882e850a80047

SHA1
a9426f28e4fd0528e695adac6e9c6bb422229f67

SHA256
cfecccae6324c4ed084d6c2ee05f191ca89c503d462314bc10ba223fea52509d

SHA512
fb1864df64ec44cde0a02b17db1d2a6a39463760bd4dc25d2cbe909f4515a1124455c52b772dedb9464ee4eb39590b8e79d6fdb12f5f66a0b4c7e7954ac15fc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25183.exe

Filesize
468KB

MD5
49dfb5ce4345f1b96b7df67dbdeb704a

SHA1
89559f0e9664e8c569d7479bfe95d6b38e2d14db

SHA256
5b870ee8fddaeba634af00193078165ad052ece5bb831365ab4268108c545841

SHA512
771b72007148a379f31a0b5327e224604ff943515ae98e00f8a76701a7d310eb5b9a95008ab91f057694f935cf9e7ff432ec213a580c813fda8230b56b2fccda

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27783.exe

Filesize
468KB

MD5
c9dbc563f74f626fbf397f3c17d50962

SHA1
f87209d4b6e46f8d329908b77ebd1b83145d3ab2

SHA256
90730278d4c592e70fbe1e7dfed622332366e3f3f4ff738a7dfab6f1c643f7da

SHA512
28b9fb93a01b6c7b92717771f5fbc656dc12f6a19c4f848dbedf3de794dabc8aea21ff7e45c5df5c4ccd1f467584103e9cba269b558b540d0f673acd52679e2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29821.exe

Filesize
468KB

MD5
c975b6021081d970ebe076dc2f12d507

SHA1
a658f0e6320cdacb980b628ea610c74346297b32

SHA256
0870336b077d4f304dc90c0af674261a7f37a5f6f20b1e41c8f0f26a33be97d5

SHA512
eab838fb9914d2dc2b2b05e77ced63c46d19b1c8a4ab9c23f057e9b4d1c05fa70b3a2be03deebb4911c40c16102b56b4fc12604bad42084cf893cf357d582f5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31104.exe

Filesize
468KB

MD5
833230ee8f8121bd81676f8b408cf354

SHA1
e9e54e94f96025612494bd32a4062c33cc717774

SHA256
0de63d870c28563c273294e7b975ba99d379b200a9296ad7ad09c60d5aa77d67

SHA512
d826955d59c231209bed056893d3523fc8095e09ea0dc7d558ba02750d8a8ad498ae0d315596a03ca5e326ba2dc85d2ec9a3324ee8cd2b260733048559558d57

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31867.exe

Filesize
468KB

MD5
0839cb95e931efc792fa129c4fb3729a

SHA1
0e9952bce76c76313bb55bd15be4bab4b54b3407

SHA256
700aa9cc2767d893d7a06a18d8364ce7a5fd627fc78128d5f82d42eeab5a14d2

SHA512
ddbff74aaa40e4f69e041d8e84201e45684fcd364092e27cb3a5a0f3a2558f78c2dd4f63acfd186ef280500304c0a95280cb7823fa6f2d389c1bf019c55a73b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34991.exe

Filesize
468KB

MD5
f164a400c96f3289598b6023d052d117

SHA1
294b93f144d07527d120850cbb6fa375ca777469

SHA256
9cf3fae51999c4b35e3580e8ddef4927e1e1a37c4de842a5304f196887d01d4e

SHA512
88a9ea55a0de81082bdce8dd2437b539a748ca4017c8b4d7e47baf6f39c5e3394bae0829c9fb11af7609b6c3cb20c6a33eea180c8a25b265dc9f04c77548a498

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35389.exe

Filesize
468KB

MD5
ca75ecc3da60e368e077694e4721b3e6

SHA1
2a46f1655c537b8ffbc95043d5a2764706388444

SHA256
59fd0a51afaff9e321982e322ad7890a5acc1c805343948a03ac0205a6022294

SHA512
df5657c6b87cb696dd30216aeda10db83075c1df10067c9f6d24e5d261b23c0f213ef31f479d604659846c2bf2ccf416b94c7c55ebe41bdd21c6b13b4ca6bdd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35913.exe

Filesize
468KB

MD5
727d9bf63ea43055edc7feadcc185c79

SHA1
63a53a1c77bcbf02886c855448a4ebee2c78f5e3

SHA256
15e6e027d87f64e3dbfdb3554fef467a54a6284649363b87471e3206b9b86308

SHA512
dfd7de45ded5d33dfa4e52865b0f6922b81cebd3786dc549d48e04ca921b763357310bd17e2e9bd59b2615c2764ca7e78f41147babb7273e416a7d8c625b0ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36807.exe

Filesize
468KB

MD5
977f572d1075465c0f14bff0974acb85

SHA1
f9217d0f39fc0d646f587e92ff0d44371cc16eff

SHA256
8fe7db4876d416a2cf34de562320650065a7f47d6fa0f2676620f5896ece964c

SHA512
97d8065ecc51ed72fd9521a025d75b5e6b1f2a261f497b642a3ac70e0ab7cd3be4b7e96a46662b797befd8ec1d98932870d9c8f549b131e844621cce271ed0ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37989.exe

Filesize
468KB

MD5
17088e6a0cb708bb0db50218e61ed7d7

SHA1
63e3c71c14e7a0f054ea6eab7d0b532a1e81656d

SHA256
dee10d3a187dcc722a4fac78e9b5f0eb59c85c25fb3d927797ce7f559c8a0b5d

SHA512
a812441a834f2326045f18459830eb4895e5a31bd745653cee3a9c6a7a400a275c97246f4cb16e6b1be9badc2b1f124284634d69a30e9a2f6b41f36682c5b464

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39770.exe

Filesize
468KB

MD5
c330c3d2489dd20ba6fd0c8339548a30

SHA1
db457c14f5d1eb1af1c9c5490435b3fc8a0767ad

SHA256
b1ab0e4a2beff7a7676c9d57fee6612fec37f94215eabd6a47ca31badaf8239e

SHA512
d8a7ee4fd9437b502c8e12272409f3d6a0a3d23226031d61a25debfdef0639a05425aed354b1012659c45d1d28682b001376eb005735704de9f16d6e6f717424

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49687.exe

Filesize
468KB

MD5
3d04a6eefdcca92980c77a344b64c925

SHA1
12e9f4bbe547ae9aacfb061654e3a2ffab8023d3

SHA256
51d93281e467fb2f9c478f7b9d174409f2c0d8f140e6ee443898dc221297283f

SHA512
6ebc5f4dcbd7e3ac76699975df605133353213d921edf6dea95e47ece728df2f06700938e4dd3aba123f7b283e988fac1b4c85347241bd91399ad8c94b7de976

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52878.exe

Filesize
468KB

MD5
3cafba2683820e0b8a23649536403cc8

SHA1
99f400f60a69f3e8336c4fb71eb23992b988bc6b

SHA256
eaa5f0762c08903c415425e43bc88b26cfb4b5eee300a51496c74aabba7cd828

SHA512
3ff3d39581ac5a29c2e3e26bbde379744889c6c55ac45d50642e03c38ba305f23a9f728ae41eb9aa1e70b89fdd00bcd5db736cd94902258c0c2d88a3a3f06bf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54186.exe

Filesize
468KB

MD5
a421e6645fdb02f50ed3fa6b9f60210c

SHA1
c806d35198355532f768908b3212d97dacb857ca

SHA256
e90c8cff2d475c5b81ab2b8e245266e5f142c51a8d3e69ea1bd058ec01805f85

SHA512
38729e3820496620feeb91a1313c75c6781a1b17df72442ec7101fdfcc9bf5f308e2bb19c980f005791fd343a31728454b43a28b422b1da2e141c920935951d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54584.exe

Filesize
468KB

MD5
e9b997db7fd797bee43c313f9ebd0d18

SHA1
bbfa7242c9e5b6aec1b920921907372f5a8b46d8

SHA256
f29095cb7ae1d02aabf73e6dd844651153d541ff00d4972c2d487f8867c16e0d

SHA512
fe9cdc6417c56348802ee62004486438fdd90991ef23d27411286c8d112ab9348f757530634a702d796a0f4063a504ccb1758e67fa30c2ca7287eecd5efb5d39

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57163.exe

Filesize
468KB

MD5
f97a9fc8a21d64a4ee02307e022d0938

SHA1
5e30eab2194926672fcc420ef57f9fe6444616f2

SHA256
06c9ff715d9de51cce0945aa1618bc2f6994aef30c82deeda0ff832d9b8cde4b

SHA512
ff5c171b6126c144d2a730d16b822c2d195166f2451f962c201b1d81460ef7c282ff2eb70f6c6b07fafe2c38308913c1fa6e8012ef912d9fe698936fc8c55922

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59863.exe

Filesize
468KB

MD5
ed208eff1cf7596e4068c5c92544516c

SHA1
b4361f338d9592cdaaba5d77a168664d520c49df

SHA256
bf7a4188837d7905650b36c9749175ebdf97d4198244d8a4b024753ffb13dc58

SHA512
bf21a4d01192f6e900ce73e438f7a46eae5b34a8d567120735811a39276ff277b1f0dbc866720ad48a3d93908bdf8d2c03a27e2c063739f7afeaed04dbe4d54c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6018.exe

Filesize
468KB

MD5
ce9205a0426529854776bbeb57d7cc4f

SHA1
fbd14220e499feaccd4ead85a13ebdce94f6be44

SHA256
3c7cd74e20724345e1db4d8282be3f960c41ae362cd51db4ac1422c7f808861f

SHA512
6d83030f253c2a8e87904854b023e5987d4319e3faad720cbf8f335a1d7b3586a2874c8a69db50665baa48bbe6812604ab1ece4e16c0c08a207d8efa32cb5c7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63195.exe

Filesize
468KB

MD5
1ff6dfbef73638c0ed77f193aa005088

SHA1
6a768870c4a8ca782297665a21a10211c8a8898a

SHA256
dff7806453a3c90f71c11b90628089a2c4f62d3000a37a9c943430e0b4586a23

SHA512
fe82b1d768d29f6e6979541aaa5033cc9dcf9b7422a6c90e245debbf4ce95eb2f26de39ab9619e2b9dc1bae7f767437df3d7b7fb42ca4a4c20306bd155654b5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8514.exe

Filesize
468KB

MD5
2572216b1bfb81d2dc426159118a9889

SHA1
1c5aa8b4c05dcdf167267adc78f2c60dc6b3085e

SHA256
f52efbe2cce438d7ed374eb87d97f5dbf21d3ccf2d3fa1c9c0ec4cca9a4b230c

SHA512
cb00614e56f24b553888c1b4ecdfc471891071b8a9ddd6d68110607502ece8ed704e71dc53fe2cdbbc445ad879665a98ed222b20d2faa1f84841505ed438eb65

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8773.exe

Filesize
468KB

MD5
e54b3d2c19e632a40b8f8bfe474db58e

SHA1
4499264a0d9e0c2f5552bba80e8f30df18994eed

SHA256
9a3c31024412a543ede9818b5b019a931802d2e94aadda2daa2e30c64e4ec1d8

SHA512
fc75e268daa5d6f5667dbd907ad731675267770742710a3848537a38fc3ac3bb896e29558f31de8b995a81abe28f9318ade60470d6ad407806f24883fb505eb4

Download Submit
memory/380-169-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/464-283-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/512-115-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/516-184-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/592-77-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/688-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/772-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/824-359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/944-387-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/956-310-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1100-85-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1140-301-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1156-300-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1164-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1224-338-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1240-38-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1412-229-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1436-48-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1452-127-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1556-58-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1584-429-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1644-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1700-192-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1748-288-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1752-190-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1864-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2100-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2136-274-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2172-168-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2248-97-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2256-433-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2304-438-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2412-368-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2580-135-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2600-309-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2668-417-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2696-218-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2824-345-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2924-249-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2932-432-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3136-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3332-248-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3364-21-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3380-334-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3424-431-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3484-261-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3504-236-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3560-194-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3596-332-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3620-247-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3628-333-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3740-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3752-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3856-400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3872-170-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3916-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4064-390-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4116-37-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4232-273-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4308-406-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4356-107-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4416-435-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4452-185-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4480-217-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4532-464-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4544-98-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4548-167-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4552-399-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4592-434-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4664-193-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4668-260-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4880-436-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4904-228-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4912-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4932-351-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4988-430-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5156-465-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5168-467-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5184-470-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5280-478-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5324-490-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5340-491-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5396-500-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5412-492-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5424-505-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5504-514-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5512-549-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5528-518-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5536-546-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5556-547-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5684-553-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5708-554-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5736-555-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5764-556-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5820-557-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5832-558-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/9036-3407-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14416-2385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14480-2379-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14728-2397-0x00007FFFC9860000-0x00007FFFC98B9000-memory.dmp

Filesize
356KB

Download
memory/14760-2400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14776-2404-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15024-2429-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads