0054646a14b0a2181e2b505c3154a39d95275352c25c4df02b3f145cb1c64c98

Analysis

max time kernel
120s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 23:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0054646a14b0a2181e2b505c3154a39d95275352c25c4df02b3f145cb1c64c98N.exe
Size

468KB
MD5

b611b756440e8f9cd2f08b95e8e86720
SHA1

bd1158568abf2610b9683f55d3bd0b0cf52df19a
SHA256

0054646a14b0a2181e2b505c3154a39d95275352c25c4df02b3f145cb1c64c98
SHA512

8f2f9265316f100f06811aa346ee085b9f1a941586dc37143ac0186f0ce185ba3bfdf0ef613c2e82967fae265145347f3d3d4c5587f8f13a47bf1b77b3b90c9e
SSDEEP

3072:IVPDog5da08uxbYLUbi/ff8/Pr5jt7pbndHttVqF5OO3CaAxWjl3:IVbob5ux0UW/ffeF765OEVAxW

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4944	Unicorn-52794.exe
3600	Unicorn-39712.exe
2220	Unicorn-50573.exe
4112	Unicorn-55830.exe
1976	Unicorn-48217.exe
4596	Unicorn-37356.exe
4176	Unicorn-31225.exe
4520	Unicorn-23926.exe
3704	Unicorn-42954.exe
1832	Unicorn-24502.exe
4396	Unicorn-32670.exe
1436	Unicorn-22556.exe
3232	Unicorn-2690.exe
600	Unicorn-16425.exe
4828	Unicorn-22291.exe
4348	Unicorn-29738.exe
3532	Unicorn-58418.exe
4144	Unicorn-44683.exe
2796	Unicorn-33822.exe
3940	Unicorn-62986.exe
3056	Unicorn-5617.exe
2472	Unicorn-2088.exe
2620	Unicorn-21954.exe
3300	Unicorn-21954.exe
3552	Unicorn-28730.exe
4864	Unicorn-56572.exe
3268	Unicorn-16915.exe
3500	Unicorn-48596.exe
5108	Unicorn-54526.exe
3376	Unicorn-25581.exe
184	Unicorn-28620.exe
4504	Unicorn-29366.exe
4232	Unicorn-31.exe
5040	Unicorn-49787.exe
2804	Unicorn-4115.exe
4604	Unicorn-10813.exe
5100	Unicorn-51489.exe
2364	Unicorn-64098.exe
396	Unicorn-33088.exe
752	Unicorn-24104.exe
2704	Unicorn-44354.exe
1012	Unicorn-42116.exe
5032	Unicorn-19658.exe
3536	Unicorn-38032.exe
3796	Unicorn-44162.exe
4032	Unicorn-5267.exe
4092	Unicorn-50939.exe
3660	Unicorn-52906.exe
4624	Unicorn-30348.exe
4276	Unicorn-30348.exe
3296	Unicorn-1759.exe
548	Unicorn-20788.exe
2440	Unicorn-11681.exe
1608	Unicorn-27447.exe
4360	Unicorn-36378.exe
2652	Unicorn-61193.exe
4708	Unicorn-5.exe
4076	Unicorn-35992.exe
2720	Unicorn-26648.exe
2144	Unicorn-41592.exe
3716	Unicorn-51344.exe
920	Unicorn-5.exe
1316	Unicorn-49761.exe
1296	Unicorn-18571.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
6824	7124	WerFault.exe	301
10652	8228	WerFault.exe	342
2448	6724	WerFault.exe	236
16728	14644	WerFault.exe	687
17312	13076	WerFault.exe	611
17340	15832	WerFault.exe	744
16576	6724	WerFault.exe	236

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54769.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33737.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1899.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10534.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48172.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34975.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64001.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58941.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40047.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2877.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9258.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14375.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47586.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37534.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12045.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56778.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55449.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53991.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29366.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17585.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27473.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7369.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45729.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59092.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2844.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16029.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33042.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52891.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58432.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20478.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32474.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62474.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14019.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22556.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37502.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65428.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13975.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17845.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39064.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63456.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13595.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50939.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49787.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40938.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21972.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7669.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48172.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29902.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13849.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3227.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38304.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1131.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32042.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32402.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6065.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1442.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62108.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	6976	dwm.exe
Token: SeChangeNotifyPrivilege	6976	dwm.exe
Token: 33	6976	dwm.exe
Token: SeIncBasePriorityPrivilege	6976	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
5052	0054646a14b0a2181e2b505c3154a39d95275352c25c4df02b3f145cb1c64c98N.exe
4944	Unicorn-52794.exe
3600	Unicorn-39712.exe
2220	Unicorn-50573.exe
4112	Unicorn-55830.exe
4176	Unicorn-31225.exe
4596	Unicorn-37356.exe
1976	Unicorn-48217.exe
4520	Unicorn-23926.exe
3704	Unicorn-42954.exe
1832	Unicorn-24502.exe
4396	Unicorn-32670.exe
600	Unicorn-16425.exe
1436	Unicorn-22556.exe
3232	Unicorn-2690.exe
4828	Unicorn-22291.exe
4348	Unicorn-29738.exe
4144	Unicorn-44683.exe
3532	Unicorn-58418.exe
2796	Unicorn-33822.exe
3940	Unicorn-62986.exe
3056	Unicorn-5617.exe
2472	Unicorn-2088.exe
2620	Unicorn-21954.exe
3268	Unicorn-16915.exe
4864	Unicorn-56572.exe
5108	Unicorn-54526.exe
3300	Unicorn-21954.exe
3552	Unicorn-28730.exe
3376	Unicorn-25581.exe
3500	Unicorn-48596.exe
184	Unicorn-28620.exe
4504	Unicorn-29366.exe
4232	Unicorn-31.exe
2804	Unicorn-4115.exe
5040	Unicorn-49787.exe
5100	Unicorn-51489.exe
4604	Unicorn-10813.exe
2364	Unicorn-64098.exe
396	Unicorn-33088.exe
752	Unicorn-24104.exe
2704	Unicorn-44354.exe
1012	Unicorn-42116.exe
5032	Unicorn-19658.exe
4032	Unicorn-5267.exe
4092	Unicorn-50939.exe
3796	Unicorn-44162.exe
3536	Unicorn-38032.exe
3660	Unicorn-52906.exe
4624	Unicorn-30348.exe
4276	Unicorn-30348.exe
3296	Unicorn-1759.exe
548	Unicorn-20788.exe
2440	Unicorn-11681.exe
4360	Unicorn-36378.exe
1608	Unicorn-27447.exe
2652	Unicorn-61193.exe
4076	Unicorn-35992.exe
1316	Unicorn-49761.exe
4708	Unicorn-5.exe
2720	Unicorn-26648.exe
2144	Unicorn-41592.exe
3716	Unicorn-51344.exe
3184	Unicorn-36191.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 4944	5052	0054646a14b0a2181e2b505c3154a39d95275352c25c4df02b3f145cb1c64c98N.exe	89
PID 5052 wrote to memory of 4944	5052	0054646a14b0a2181e2b505c3154a39d95275352c25c4df02b3f145cb1c64c98N.exe	89
PID 5052 wrote to memory of 4944	5052	0054646a14b0a2181e2b505c3154a39d95275352c25c4df02b3f145cb1c64c98N.exe	89
PID 4944 wrote to memory of 3600	4944	Unicorn-52794.exe	94
PID 4944 wrote to memory of 3600	4944	Unicorn-52794.exe	94
PID 4944 wrote to memory of 3600	4944	Unicorn-52794.exe	94
PID 5052 wrote to memory of 2220	5052	0054646a14b0a2181e2b505c3154a39d95275352c25c4df02b3f145cb1c64c98N.exe	95
PID 5052 wrote to memory of 2220	5052	0054646a14b0a2181e2b505c3154a39d95275352c25c4df02b3f145cb1c64c98N.exe	95
PID 5052 wrote to memory of 2220	5052	0054646a14b0a2181e2b505c3154a39d95275352c25c4df02b3f145cb1c64c98N.exe	95
PID 3600 wrote to memory of 4112	3600	Unicorn-39712.exe	97
PID 3600 wrote to memory of 4112	3600	Unicorn-39712.exe	97
PID 3600 wrote to memory of 4112	3600	Unicorn-39712.exe	97
PID 4944 wrote to memory of 1976	4944	Unicorn-52794.exe	98
PID 4944 wrote to memory of 1976	4944	Unicorn-52794.exe	98
PID 4944 wrote to memory of 1976	4944	Unicorn-52794.exe	98
PID 2220 wrote to memory of 4596	2220	Unicorn-50573.exe	100
PID 2220 wrote to memory of 4596	2220	Unicorn-50573.exe	100
PID 2220 wrote to memory of 4596	2220	Unicorn-50573.exe	100
PID 5052 wrote to memory of 4176	5052	0054646a14b0a2181e2b505c3154a39d95275352c25c4df02b3f145cb1c64c98N.exe	99
PID 5052 wrote to memory of 4176	5052	0054646a14b0a2181e2b505c3154a39d95275352c25c4df02b3f145cb1c64c98N.exe	99
PID 5052 wrote to memory of 4176	5052	0054646a14b0a2181e2b505c3154a39d95275352c25c4df02b3f145cb1c64c98N.exe	99
PID 4112 wrote to memory of 4520	4112	Unicorn-55830.exe	104
PID 4112 wrote to memory of 4520	4112	Unicorn-55830.exe	104
PID 4112 wrote to memory of 4520	4112	Unicorn-55830.exe	104
PID 3600 wrote to memory of 3704	3600	Unicorn-39712.exe	105
PID 3600 wrote to memory of 3704	3600	Unicorn-39712.exe	105
PID 3600 wrote to memory of 3704	3600	Unicorn-39712.exe	105
PID 4596 wrote to memory of 1832	4596	Unicorn-37356.exe	106
PID 4596 wrote to memory of 1832	4596	Unicorn-37356.exe	106
PID 4596 wrote to memory of 1832	4596	Unicorn-37356.exe	106
PID 4176 wrote to memory of 4396	4176	Unicorn-31225.exe	107
PID 4176 wrote to memory of 4396	4176	Unicorn-31225.exe	107
PID 4176 wrote to memory of 4396	4176	Unicorn-31225.exe	107
PID 1976 wrote to memory of 1436	1976	Unicorn-48217.exe	109
PID 1976 wrote to memory of 1436	1976	Unicorn-48217.exe	109
PID 1976 wrote to memory of 1436	1976	Unicorn-48217.exe	109
PID 2220 wrote to memory of 3232	2220	Unicorn-50573.exe	111
PID 2220 wrote to memory of 3232	2220	Unicorn-50573.exe	111
PID 2220 wrote to memory of 3232	2220	Unicorn-50573.exe	111
PID 4944 wrote to memory of 600	4944	Unicorn-52794.exe	108
PID 4944 wrote to memory of 600	4944	Unicorn-52794.exe	108
PID 4944 wrote to memory of 600	4944	Unicorn-52794.exe	108
PID 5052 wrote to memory of 4828	5052	0054646a14b0a2181e2b505c3154a39d95275352c25c4df02b3f145cb1c64c98N.exe	110
PID 5052 wrote to memory of 4828	5052	0054646a14b0a2181e2b505c3154a39d95275352c25c4df02b3f145cb1c64c98N.exe	110
PID 5052 wrote to memory of 4828	5052	0054646a14b0a2181e2b505c3154a39d95275352c25c4df02b3f145cb1c64c98N.exe	110
PID 4520 wrote to memory of 4348	4520	Unicorn-23926.exe	112
PID 4520 wrote to memory of 4348	4520	Unicorn-23926.exe	112
PID 4520 wrote to memory of 4348	4520	Unicorn-23926.exe	112
PID 3600 wrote to memory of 3532	3600	Unicorn-39712.exe	114
PID 3600 wrote to memory of 3532	3600	Unicorn-39712.exe	114
PID 3600 wrote to memory of 3532	3600	Unicorn-39712.exe	114
PID 4112 wrote to memory of 4144	4112	Unicorn-55830.exe	113
PID 4112 wrote to memory of 4144	4112	Unicorn-55830.exe	113
PID 4112 wrote to memory of 4144	4112	Unicorn-55830.exe	113
PID 3704 wrote to memory of 2796	3704	Unicorn-42954.exe	115
PID 3704 wrote to memory of 2796	3704	Unicorn-42954.exe	115
PID 3704 wrote to memory of 2796	3704	Unicorn-42954.exe	115
PID 1832 wrote to memory of 3940	1832	Unicorn-24502.exe	116
PID 1832 wrote to memory of 3940	1832	Unicorn-24502.exe	116
PID 1832 wrote to memory of 3940	1832	Unicorn-24502.exe	116
PID 4396 wrote to memory of 3056	4396	Unicorn-32670.exe	117
PID 4396 wrote to memory of 3056	4396	Unicorn-32670.exe	117
PID 4396 wrote to memory of 3056	4396	Unicorn-32670.exe	117
PID 4596 wrote to memory of 2472	4596	Unicorn-37356.exe	118

C:\Users\Admin\AppData\Local\Temp\0054646a14b0a2181e2b505c3154a39d95275352c25c4df02b3f145cb1c64c98N.exe
"C:\Users\Admin\AppData\Local\Temp\0054646a14b0a2181e2b505c3154a39d95275352c25c4df02b3f145cb1c64c98N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39712.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39712.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55830.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23926.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29738.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28620.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11681.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3679.exe
        9⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32242.exe
        10⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11349.exe
        11⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23488.exe
        12⤵
        
        PID:11644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13341.exe
        12⤵
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54769.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:11760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40788.exe
        11⤵
        
        PID:15644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21920.exe
        11⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23362.exe
        10⤵
        
        PID:9196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56636.exe
        10⤵
        
        PID:12768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26607.exe
        10⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60171.exe
        9⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7369.exe
        10⤵
        
        PID:10908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32698.exe
        10⤵
        
        PID:13964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62516.exe
        10⤵
        
        PID:17548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63486.exe
        9⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41786.exe
        10⤵
        
        PID:10216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7837.exe
        9⤵
        
        PID:15372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49594.exe
        9⤵
        
        PID:17444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46035.exe
        8⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14089.exe
        9⤵
        
        PID:7764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45662.exe
        10⤵
        
        PID:12024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42018.exe
        10⤵
        
        PID:14756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26014.exe
        9⤵
        
        PID:10712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34181.exe
        9⤵
        
        PID:12552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35754.exe
        8⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7124 -s 248
        9⤵
        Program crash
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34707.exe
        8⤵
        
        PID:9612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62108.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37534.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25256.exe
        7⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61816.exe
        8⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28776.exe
        9⤵
        
        PID:8672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63015.exe
        9⤵
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10534.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24298.exe
        9⤵
        
        PID:18044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46138.exe
        8⤵
        
        PID:11916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3622.exe
        8⤵
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52937.exe
        7⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54302.exe
        8⤵
        
        PID:9280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16964.exe
        8⤵
        
        PID:13892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58432.exe
        8⤵
        
        PID:18180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27473.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33128.exe
        7⤵
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32042.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29366.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51344.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22346.exe
        8⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52958.exe
        9⤵
        
        PID:8500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-114.exe
        9⤵
        
        PID:12300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16117.exe
        9⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48172.exe
        8⤵
        
        PID:9304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30535.exe
        8⤵
        
        PID:13920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55632.exe
        8⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28328.exe
        7⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63456.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40592.exe
        9⤵
        
        PID:12452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50561.exe
        9⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54961.exe
        8⤵
        
        PID:11800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42298.exe
        8⤵
        
        PID:17032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49734.exe
        7⤵
        
        PID:8620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24567.exe
        7⤵
        
        PID:13148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9233.exe
        7⤵
        
        PID:13216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26739.exe
        6⤵
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59486.exe
        7⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32730.exe
        8⤵
        
        PID:8332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52460.exe
        9⤵
        
        PID:10648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13595.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32402.exe
        8⤵
        
        PID:11880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1727.exe
        8⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35230.exe
        7⤵
        
        PID:8560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13849.exe
        7⤵
        
        PID:12220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26067.exe
        7⤵
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60373.exe
        6⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4053.exe
        7⤵
        
        PID:10828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34452.exe
        7⤵
        
        PID:14548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58432.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8615.exe
        6⤵
        
        PID:9368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19724.exe
        6⤵
        
        PID:12264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2877.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44683.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4115.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5.exe
        7⤵
        Executes dropped EXE
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30850.exe
        8⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12439.exe
        9⤵
        
        PID:9104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63015.exe
        9⤵
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60424.exe
        8⤵
        
        PID:9768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8168.exe
        8⤵
        
        PID:12484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42526.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7540.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54602.exe
        8⤵
        
        PID:14332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6755.exe
        7⤵
        
        PID:9584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4084.exe
        7⤵
        
        PID:13024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6590.exe
        6⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51318.exe
        7⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15988.exe
        8⤵
        
        PID:7840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27380.exe
        9⤵
        
        PID:11832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8770.exe
        9⤵
        
        PID:14528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2967.exe
        8⤵
        
        PID:11676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27261.exe
        8⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64120.exe
        7⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21660.exe
        7⤵
        
        PID:12832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42098.exe
        7⤵
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48094.exe
        6⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9761.exe
        7⤵
        
        PID:8768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16362.exe
        7⤵
        
        PID:14740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        7⤵
        
        PID:13480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7960.exe
        6⤵
        
        PID:9112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53836.exe
        6⤵
        
        PID:12744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28048.exe
        6⤵
        
        PID:5844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10813.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6393.exe
        7⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59372.exe
        8⤵
        
        PID:8460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42772.exe
        9⤵
        
        PID:18416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-114.exe
        8⤵
        
        PID:12308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11841.exe
        8⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48172.exe
        7⤵
        
        PID:9664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8168.exe
        7⤵
        
        PID:12788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24111.exe
        7⤵
        
        PID:9480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12376.exe
        6⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43446.exe
        7⤵
        
        PID:8068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4053.exe
        8⤵
        
        PID:10664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30368.exe
        8⤵
        
        PID:14516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56870.exe
        8⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-140.exe
        7⤵
        
        PID:8588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48956.exe
        7⤵
        
        PID:14640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2506.exe
        6⤵
        
        PID:8456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1319.exe
        6⤵
        
        PID:12972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60913.exe
        6⤵
        
        PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52833.exe
        5⤵
        
        PID:5156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23114.exe
        6⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28646.exe
        7⤵
        
        PID:8356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12045.exe
        8⤵
        
        PID:18388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32402.exe
        7⤵
        
        PID:12048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31239.exe
        7⤵
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47483.exe
        6⤵
        
        PID:8752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14375.exe
        7⤵
        
        PID:18020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13849.exe
        6⤵
        
        PID:12292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28553.exe
        6⤵
        
        PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54038.exe
        5⤵
        
        PID:7076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26014.exe
        6⤵
        
        PID:10676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48380.exe
        6⤵
        
        PID:4904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64297.exe
        6⤵
        
        PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41088.exe
        5⤵
        
        PID:9340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24537.exe
        5⤵
        
        PID:14100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51543.exe
        5⤵
        
        PID:7340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42954.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33822.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8173.exe
        7⤵
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8531.exe
        8⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9403.exe
        9⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26052.exe
        10⤵
        
        PID:15212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33772.exe
        9⤵
        
        PID:8208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1701.exe
        9⤵
        
        PID:14672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48172.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53093.exe
        8⤵
        
        PID:12388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9662.exe
        7⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49258.exe
        8⤵
        
        PID:8964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55537.exe
        8⤵
        
        PID:12428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63720.exe
        8⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49926.exe
        7⤵
        
        PID:8368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46741.exe
        7⤵
        
        PID:12920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13125.exe
        7⤵
        
        PID:3204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33232.exe
        6⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50140.exe
        7⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12309.exe
        8⤵
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52823.exe
        8⤵
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21982.exe
        8⤵
        
        PID:9672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        7⤵
        
        PID:8696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41260.exe
        7⤵
        
        PID:13128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5070.exe
        7⤵
        
        PID:15488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14399.exe
        6⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42180.exe
        7⤵
        
        PID:10960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21982.exe
        7⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47177.exe
        6⤵
        
        PID:8944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33135.exe
        6⤵
        
        PID:14436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37342.exe
        6⤵
        
        PID:9400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49787.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36378.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62802.exe
        7⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40602.exe
        8⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4053.exe
        9⤵
        
        PID:10896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32506.exe
        9⤵
        
        PID:14600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24633.exe
        9⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58941.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34783.exe
        8⤵
        
        PID:13840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64297.exe
        8⤵
        
        PID:8800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52579.exe
        7⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5615.exe
        8⤵
        
        PID:11260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47586.exe
        8⤵
        
        PID:15832
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15832 -s 72
        9⤵
        Program crash
        
        PID:17340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12958.exe
        8⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31197.exe
        7⤵
        
        PID:8948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58235.exe
        7⤵
        
        PID:13492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33974.exe
        6⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47120.exe
        7⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8228 -s 488
        8⤵
        Program crash
        
        PID:10652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54961.exe
        7⤵
        
        PID:11796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43684.exe
        7⤵
        
        PID:6416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65302.exe
        6⤵
        
        PID:8712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12045.exe
        7⤵
        
        PID:18104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19714.exe
        6⤵
        
        PID:12380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13317.exe
        6⤵
        
        PID:9684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18571.exe
        5⤵
        Executes dropped EXE
        
        PID:1296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49564.exe
        6⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51396.exe
        7⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42900.exe
        7⤵
        
        PID:12712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48406.exe
        7⤵
        
        PID:928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8204.exe
        6⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28408.exe
        7⤵
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1021.exe
        6⤵
        
        PID:11320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13317.exe
        6⤵
        
        PID:7280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53959.exe
        5⤵
        
        PID:6788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33860.exe
        6⤵
        
        PID:8868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5873.exe
        6⤵
        
        PID:13048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49549.exe
        6⤵
        
        PID:6384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50634.exe
        5⤵
        
        PID:7232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59859.exe
        5⤵
        
        PID:12636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12249.exe
        5⤵
        
        PID:5360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58418.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50939.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64748.exe
        6⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17468.exe
        7⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38328.exe
        8⤵
        
        PID:9420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59672.exe
        8⤵
        
        PID:12988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45729.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33042.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50798.exe
        7⤵
        
        PID:12492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39243.exe
        7⤵
        
        PID:6208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24820.exe
        6⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4053.exe
        7⤵
        
        PID:10836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12086.exe
        7⤵
        
        PID:14580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36844.exe
        6⤵
        
        PID:9796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2906.exe
        6⤵
        
        PID:14720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6431.exe
        6⤵
        
        PID:17596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59770.exe
        5⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40732.exe
        6⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12221.exe
        7⤵
        
        PID:10936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53503.exe
        7⤵
        
        PID:14664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23876.exe
        6⤵
        
        PID:10584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16502.exe
        6⤵
        
        PID:15164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41619.exe
        5⤵
        
        PID:6588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64328.exe
        6⤵
        
        PID:11860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47665.exe
        6⤵
        
        PID:14524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3393.exe
        6⤵
        
        PID:8628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31879.exe
        5⤵
        
        PID:8512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45572.exe
        5⤵
        
        PID:14488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6961.exe
        5⤵
        
        PID:7532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51489.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26648.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36160.exe
        6⤵
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43446.exe
        7⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4053.exe
        8⤵
        
        PID:10708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41172.exe
        8⤵
        
        PID:16568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3638.exe
        8⤵
        
        PID:1456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-140.exe
        7⤵
        
        PID:9320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19791.exe
        7⤵
        
        PID:12096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64297.exe
        7⤵
        
        PID:8316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34078.exe
        6⤵
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63944.exe
        7⤵
        
        PID:10860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55449.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34679.exe
        6⤵
        
        PID:10524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49969.exe
        6⤵
        
        PID:14504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58782.exe
        6⤵
        
        PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9470.exe
        5⤵
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30813.exe
        6⤵
        
        PID:9824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30395.exe
        6⤵
        
        PID:14904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61218.exe
        5⤵
        
        PID:8760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7151.exe
        6⤵
        
        PID:11316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48625.exe
        6⤵
        
        PID:17024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3393.exe
        6⤵
        
        PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5533.exe
        5⤵
        
        PID:12160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36191.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:3184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6393.exe
        5⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33860.exe
        6⤵
        
        PID:8860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23965.exe
        6⤵
        
        PID:14012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10150.exe
        5⤵
        
        PID:6956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9865.exe
        6⤵
        
        PID:12472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34224.exe
        6⤵
        
        PID:7364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1021.exe
        5⤵
        
        PID:11368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12994.exe
        5⤵
        
        PID:17072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37502.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7369.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47586.exe
        5⤵
        
        PID:15812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58154.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58154.exe
      4⤵
      PID:9328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3007.exe
      4⤵
      PID:14020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23458.exe
      4⤵
      PID:8984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48217.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48217.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22556.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21954.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30348.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7187.exe
        7⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20888.exe
        8⤵
        
        PID:8024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25434.exe
        9⤵
        
        PID:11808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-410.exe
        9⤵
        
        PID:15408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22698.exe
        8⤵
        
        PID:9088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30097.exe
        8⤵
        
        PID:14340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21894.exe
        8⤵
        
        PID:17556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17742.exe
        7⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40426.exe
        8⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46974.exe
        8⤵
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2199.exe
        7⤵
        
        PID:9432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25657.exe
        7⤵
        
        PID:11692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63800.exe
        7⤵
        
        PID:8956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29698.exe
        6⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8635.exe
        7⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56778.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62474.exe
        7⤵
        
        PID:11468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7592.exe
        7⤵
        
        PID:2360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7741.exe
        6⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47416.exe
        7⤵
        
        PID:11496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12033.exe
        7⤵
        
        PID:13504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40214.exe
        6⤵
        
        PID:13008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50607.exe
        6⤵
        
        PID:16668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17585.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35942.exe
        6⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28646.exe
        7⤵
        
        PID:8432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34796.exe
        8⤵
        
        PID:17860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32402.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42298.exe
        7⤵
        
        PID:16992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1380.exe
        6⤵
        
        PID:8408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22401.exe
        6⤵
        
        PID:12948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7592.exe
        6⤵
        
        PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29647.exe
        5⤵
        
        PID:1600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26014.exe
        6⤵
        
        PID:10668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56740.exe
        6⤵
        
        PID:14328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11012.exe
        6⤵
        
        PID:17668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34681.exe
        5⤵
        
        PID:8900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15318.exe
        5⤵
        
        PID:13068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4849.exe
        5⤵
        
        PID:7300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28730.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19658.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25470.exe
        6⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54224.exe
        7⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10555.exe
        8⤵
        
        PID:8912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-114.exe
        8⤵
        
        PID:32
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        8⤵
        
        PID:13212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        7⤵
        
        PID:8720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30608.exe
        8⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54691.exe
        7⤵
        
        PID:13952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-664.exe
        6⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20670.exe
        7⤵
        
        PID:8280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42900.exe
        7⤵
        
        PID:12696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1727.exe
        7⤵
        
        PID:1140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34897.exe
        6⤵
        
        PID:10236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37909.exe
        6⤵
        
        PID:14300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64376.exe
        6⤵
        
        PID:17520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5604.exe
        5⤵
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25636.exe
        6⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36944.exe
        7⤵
        
        PID:9880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40866.exe
        7⤵
        
        PID:13000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45729.exe
        6⤵
        
        PID:9068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4119.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39627.exe
        6⤵
        
        PID:7272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8369.exe
        5⤵
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4053.exe
        6⤵
        
        PID:10684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18116.exe
        6⤵
        
        PID:14456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58432.exe
        6⤵
        
        PID:18204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63321.exe
        5⤵
        
        PID:9964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51802.exe
        5⤵
        
        PID:14292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47840.exe
        5⤵
        
        PID:8844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38032.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62802.exe
        5⤵
        
        PID:5276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6907.exe
        6⤵
        
        PID:7536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59284.exe
        7⤵
        
        PID:11072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6440.exe
        7⤵
        
        PID:14932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34311.exe
        7⤵
        
        PID:17784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17462.exe
        6⤵
        
        PID:8364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32043.exe
        6⤵
        
        PID:14288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6928.exe
        6⤵
        
        PID:17828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27088.exe
        5⤵
        
        PID:7940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40426.exe
        6⤵
        
        PID:8240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20393.exe
        6⤵
        
        PID:15740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61130.exe
        5⤵
        
        PID:10992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32850.exe
        6⤵
        
        PID:17776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35963.exe
        5⤵
        
        PID:14372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4293.exe
        5⤵
        
        PID:9656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53575.exe
      4⤵
      PID:6288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44598.exe
        5⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64328.exe
        6⤵
        
        PID:11868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64001.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3393.exe
        6⤵
        
        PID:7420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52823.exe
        5⤵
        
        PID:11352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57307.exe
        5⤵
        
        PID:4840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31775.exe
      4⤵
      PID:8728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46114.exe
        5⤵
        
        PID:4528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60051.exe
      4⤵
      PID:12340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36562.exe
      4⤵
      PID:5916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16425.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16425.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48596.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17856.exe
        5⤵
        
        PID:5700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1131.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23026.exe
        7⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7753.exe
        8⤵
        
        PID:9476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32698.exe
        8⤵
        
        PID:14784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49917.exe
        7⤵
        
        PID:10224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46434.exe
        7⤵
        
        PID:8228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7504.exe
        7⤵
        
        PID:9556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22018.exe
        6⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2491.exe
        7⤵
        
        PID:11028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56217.exe
        7⤵
        
        PID:16720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27731.exe
        7⤵
        
        PID:368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61322.exe
        6⤵
        
        PID:10368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5236.exe
        6⤵
        
        PID:14644
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14644 -s 216
        7⤵
        Program crash
        
        PID:16728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36389.exe
        6⤵
        
        PID:6900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16537.exe
        5⤵
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54302.exe
        6⤵
        
        PID:9288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64219.exe
        6⤵
        
        PID:8288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20342.exe
        5⤵
        
        PID:9456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56839.exe
        5⤵
        
        PID:15052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49761.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5817.exe
        5⤵
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34702.exe
        6⤵
        
        PID:8008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33218.exe
        7⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56025.exe
        7⤵
        
        PID:15600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3227.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37586.exe
        6⤵
        
        PID:12084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61619.exe
        6⤵
        
        PID:12840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-593.exe
        6⤵
        
        PID:7388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1598.exe
        5⤵
        
        PID:7572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27087.exe
        5⤵
        
        PID:10628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38101.exe
        5⤵
        
        PID:14892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23343.exe
        5⤵
        
        PID:6632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47710.exe
      4⤵
      PID:6268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27686.exe
        5⤵
        
        PID:6924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52891.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52823.exe
        5⤵
        
        PID:10464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49549.exe
        5⤵
        
        PID:3108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5630.exe
      4⤵
      PID:8664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11049.exe
      4⤵
      PID:12324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62319.exe
      4⤵
      PID:13512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25581.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25581.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17856.exe
      4⤵
      PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49756.exe
        5⤵
        
        PID:6328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31874.exe
        6⤵
        
        PID:10972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6056.exe
        6⤵
        
        PID:14768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7669.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51567.exe
        5⤵
        
        PID:8684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13849.exe
        5⤵
        
        PID:11336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51111.exe
        5⤵
        
        PID:14560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9967.exe
      4⤵
      PID:6448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18343.exe
        5⤵
        
        PID:1144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31687.exe
        5⤵
        
        PID:14564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59716.exe
        5⤵
        
        PID:6752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52091.exe
      4⤵
      PID:9392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24007.exe
      4⤵
      PID:14000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27447.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27447.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28568.exe
      4⤵
      PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65428.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25818.exe
        6⤵
        
        PID:11112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29948.exe
        6⤵
        
        PID:6584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-140.exe
        5⤵
        
        PID:8892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30097.exe
        5⤵
        
        PID:14700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19756.exe
        5⤵
        
        PID:17456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20072.exe
      4⤵
      PID:6932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35832.exe
      4⤵
      PID:11416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46051.exe
      4⤵
      PID:17372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39064.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39064.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65402.exe
      4⤵
      PID:7696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47006.exe
        5⤵
        
        PID:12908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39268.exe
        5⤵
        
        PID:6324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52823.exe
      4⤵
      PID:10988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47586.exe
      4⤵
      PID:15804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58267.exe
      4⤵
      PID:7920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44942.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44942.exe
    3⤵
    PID:9016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26997.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26997.exe
    3⤵
    PID:12504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53250.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53250.exe
    3⤵
    PID:4884
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50573.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50573.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37356.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37356.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24502.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62986.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33088.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53098.exe
        7⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7161.exe
        8⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22533.exe
        9⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43014.exe
        9⤵
        
        PID:13016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18630.exe
        9⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15002.exe
        8⤵
        
        PID:9136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14198.exe
        8⤵
        
        PID:12524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60171.exe
        7⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28776.exe
        8⤵
        
        PID:9552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10637.exe
        8⤵
        
        PID:3876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9258.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41120.exe
        7⤵
        
        PID:8736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60467.exe
        7⤵
        
        PID:14276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64376.exe
        7⤵
        
        PID:17808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14758.exe
        6⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-363.exe
        7⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51204.exe
        8⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46472.exe
        9⤵
        
        PID:9256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20150.exe
        8⤵
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42298.exe
        8⤵
        
        PID:17040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60232.exe
        7⤵
        
        PID:9436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36565.exe
        7⤵
        
        PID:13872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49986.exe
        7⤵
        
        PID:820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42064.exe
        6⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51396.exe
        7⤵
        
        PID:8236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42900.exe
        7⤵
        
        PID:12704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50736.exe
        7⤵
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55791.exe
        6⤵
        
        PID:9592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19923.exe
        6⤵
        
        PID:14316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24104.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38708.exe
        6⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30898.exe
        7⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8635.exe
        8⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53358.exe
        9⤵
        
        PID:11400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62474.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6047.exe
        8⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24732.exe
        7⤵
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52460.exe
        8⤵
        
        PID:10436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14519.exe
        8⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35832.exe
        7⤵
        
        PID:11460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14049.exe
        7⤵
        
        PID:16696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3632.exe
        6⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36944.exe
        7⤵
        
        PID:9872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19460.exe
        7⤵
        
        PID:232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10455.exe
        6⤵
        
        PID:9160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62501.exe
        6⤵
        
        PID:12736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17401.exe
        6⤵
        
        PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40938.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30850.exe
        6⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32922.exe
        7⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65459.exe
        7⤵
        
        PID:12648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1727.exe
        7⤵
        
        PID:1216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60424.exe
        6⤵
        
        PID:9696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8168.exe
        6⤵
        
        PID:12904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53959.exe
        5⤵
        
        PID:6808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43446.exe
        6⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27380.exe
        7⤵
        
        PID:11840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16117.exe
        7⤵
        
        PID:7288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47587.exe
        6⤵
        
        PID:10388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64908.exe
        6⤵
        
        PID:14396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9518.exe
        5⤵
        
        PID:7796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47032.exe
        6⤵
        
        PID:10844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33082.exe
        6⤵
        
        PID:14920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7093.exe
        6⤵
        
        PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49168.exe
        5⤵
        
        PID:11728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59130.exe
        5⤵
        
        PID:14656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45129.exe
        5⤵
        
        PID:8168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2088.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44354.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12449.exe
        6⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33804.exe
        7⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63046.exe
        8⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6724 -s 636
        8⤵
        Program crash
        
        PID:2448
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6724 -s 636
        8⤵
        Program crash
        
        PID:16576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1380.exe
        7⤵
        
        PID:8400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15796.exe
        7⤵
        
        PID:13848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41696.exe
        6⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5231.exe
        7⤵
        
        PID:10864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4110.exe
        7⤵
        
        PID:15212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31405.exe
        7⤵
        
        PID:7904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26729.exe
        6⤵
        
        PID:9032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30395.exe
        6⤵
        
        PID:15060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56009.exe
        6⤵
        
        PID:9248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5604.exe
        5⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13383.exe
        6⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50581.exe
        7⤵
        
        PID:9492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48060.exe
        8⤵
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34975.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46305.exe
        6⤵
        
        PID:8508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6065.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44349.exe
        6⤵
        
        PID:1448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4285.exe
        5⤵
        
        PID:7088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6217.exe
        6⤵
        
        PID:9864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21982.exe
        6⤵
        
        PID:7664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13004.exe
        5⤵
        
        PID:9512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17977.exe
        5⤵
        
        PID:12104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42116.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25470.exe
        5⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25636.exe
        6⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20478.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29902.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31431.exe
        8⤵
        
        PID:7336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32402.exe
        7⤵
        
        PID:12148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57882.exe
        7⤵
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23746.exe
        6⤵
        
        PID:8580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34653.exe
        6⤵
        
        PID:13076
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13076 -s 452
        7⤵
        Program crash
        
        PID:17312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22715.exe
        6⤵
        
        PID:732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60171.exe
        5⤵
        
        PID:6412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12501.exe
        6⤵
        
        PID:9188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42900.exe
        6⤵
        
        PID:12688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57150.exe
        6⤵
        
        PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14285.exe
        5⤵
        
        PID:9780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62127.exe
        5⤵
        
        PID:16876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25205.exe
      4⤵
      PID:5656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33336.exe
        5⤵
        
        PID:1672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12221.exe
        6⤵
        
        PID:11064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16117.exe
        6⤵
        
        PID:7456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2225.exe
        5⤵
        
        PID:8516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
        5⤵
        
        PID:15580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13737.exe
      4⤵
      PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42948.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53503.exe
        5⤵
        
        PID:14684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58432.exe
        5⤵
        
        PID:18196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32474.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35996.exe
      4⤵
      PID:14964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14019.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2690.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2690.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21954.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5267.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46035.exe
        6⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31770.exe
        7⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14375.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:18008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22096.exe
        7⤵
        
        PID:11356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35927.exe
        7⤵
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24269.exe
        6⤵
        
        PID:8376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12045.exe
        7⤵
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52003.exe
        6⤵
        
        PID:11988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39498.exe
        6⤵
        
        PID:16724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60922.exe
        5⤵
        
        PID:7152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50348.exe
        6⤵
        
        PID:11036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32698.exe
        6⤵
        
        PID:10948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12620.exe
        5⤵
        
        PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38460.exe
        5⤵
        
        PID:13120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62127.exe
        5⤵
        
        PID:3644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20788.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41998.exe
        5⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40794.exe
        6⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6575.exe
        7⤵
        
        PID:11008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-410.exe
        7⤵
        
        PID:14736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3393.exe
        7⤵
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57379.exe
        6⤵
        
        PID:9576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24861.exe
        6⤵
        
        PID:12676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52579.exe
        5⤵
        
        PID:7548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4053.exe
        6⤵
        
        PID:10700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18116.exe
        6⤵
        
        PID:14828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53564.exe
        5⤵
        
        PID:9092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40047.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51410.exe
      4⤵
      PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15988.exe
        5⤵
        
        PID:7848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12045.exe
        6⤵
        
        PID:13928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2967.exe
        5⤵
        
        PID:11684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46653.exe
        5⤵
        
        PID:14620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18183.exe
      4⤵
      PID:7816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51500.exe
        5⤵
        
        PID:11588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35220.exe
        5⤵
        
        PID:15480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3393.exe
        5⤵
        
        PID:1820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-167.exe
      4⤵
      PID:11700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64431.exe
      4⤵
      PID:15508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1123.exe
      4⤵
      PID:1064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54526.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54526.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30348.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23284.exe
        5⤵
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15988.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49454.exe
        6⤵
        
        PID:11488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52491.exe
        6⤵
        
        PID:15076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63800.exe
        6⤵
        
        PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12318.exe
        5⤵
        
        PID:7760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27380.exe
        6⤵
        
        PID:11664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47665.exe
        6⤵
        
        PID:11444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3393.exe
        6⤵
        
        PID:7296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8832.exe
        5⤵
        
        PID:11752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25910.exe
        5⤵
        
        PID:5396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44586.exe
      4⤵
      PID:7044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59092.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38304.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32698.exe
        5⤵
        
        PID:14052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16029.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-752.exe
      4⤵
      PID:9968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65040.exe
      4⤵
      PID:12368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61193.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61193.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51510.exe
      4⤵
      PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2413.exe
        5⤵
        
        PID:8128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47032.exe
        6⤵
        
        PID:10660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28806.exe
        6⤵
        
        PID:14792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45028.exe
        6⤵
        
        PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62474.exe
        5⤵
        
        PID:11484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19652.exe
        5⤵
        
        PID:2504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48172.exe
      4⤵
      PID:9296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30727.exe
      4⤵
      PID:10372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44910.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44910.exe
    3⤵
    PID:6280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51204.exe
      4⤵
      PID:7476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54961.exe
      4⤵
      PID:11788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1727.exe
      4⤵
      PID:2292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45966.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45966.exe
    3⤵
    PID:8700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11579.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11579.exe
    3⤵
    PID:12348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12737.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12737.exe
    3⤵
    PID:1432
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31225.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31225.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32670.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32670.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5617.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44162.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39860.exe
        6⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1899.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4053.exe
        8⤵
        
        PID:10892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32506.exe
        8⤵
        
        PID:14608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16029.exe
        8⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55241.exe
        7⤵
        
        PID:9720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12045.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:18396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2303.exe
        7⤵
        
        PID:12500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53991.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21852.exe
        6⤵
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4053.exe
        7⤵
        
        PID:10640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18116.exe
        7⤵
        
        PID:14448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40737.exe
        6⤵
        
        PID:3932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16991.exe
        6⤵
        
        PID:12124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43756.exe
        6⤵
        
        PID:8592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45651.exe
        5⤵
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33140.exe
        6⤵
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19404.exe
        7⤵
        
        PID:12052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52.exe
        7⤵
        
        PID:1204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20944.exe
        6⤵
        
        PID:10360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64908.exe
        6⤵
        
        PID:14776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2844.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19417.exe
        5⤵
        
        PID:7584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49274.exe
        6⤵
        
        PID:12956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18370.exe
        5⤵
        
        PID:11340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2123.exe
        6⤵
        
        PID:17956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36041.exe
        5⤵
        
        PID:15652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46880.exe
        5⤵
        
        PID:7876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35676.exe
      4⤵
      PID:5744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29828.exe
        5⤵
        
        PID:7216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42180.exe
        6⤵
        
        PID:11056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16362.exe
        6⤵
        
        PID:14352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9231.exe
        6⤵
        
        PID:8940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41312.exe
        5⤵
        
        PID:9460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5236.exe
        5⤵
        
        PID:14708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11179.exe
        5⤵
        
        PID:15060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14234.exe
      4⤵
      PID:6684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59564.exe
        5⤵
        
        PID:8220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57534.exe
        5⤵
        
        PID:14044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35257.exe
      4⤵
      PID:9380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1442.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7537.exe
      4⤵
      PID:8832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64098.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64098.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45122.exe
      4⤵
      PID:1708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22922.exe
        5⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54328.exe
        6⤵
        
        PID:7736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45662.exe
        7⤵
        
        PID:12016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25490.exe
        7⤵
        
        PID:16744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5173.exe
        7⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50109.exe
        6⤵
        
        PID:11424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15899.exe
        6⤵
        
        PID:15064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15096.exe
        6⤵
        
        PID:17896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48172.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12045.exe
        6⤵
        
        PID:18404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38895.exe
        5⤵
        
        PID:13004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47072.exe
      4⤵
      PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7514.exe
        5⤵
        
        PID:11648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6954.exe
        5⤵
        
        PID:17144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42709.exe
      4⤵
      PID:9804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45964.exe
      4⤵
      PID:14844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51349.exe
      4⤵
      PID:17416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42527.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42527.exe
    3⤵
    PID:5248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35558.exe
      4⤵
      PID:6148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27686.exe
        5⤵
        
        PID:6560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33488.exe
        6⤵
        
        PID:17328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59279.exe
        6⤵
        
        PID:17564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52823.exe
        5⤵
        
        PID:9912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47586.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45439.exe
        5⤵
        
        PID:7916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8588.exe
      4⤵
      PID:8652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13849.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30151.exe
      4⤵
      PID:1364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45294.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45294.exe
    3⤵
    PID:6784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13975.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6056.exe
      4⤵
      PID:13876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48296.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48296.exe
    3⤵
    PID:9128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54366.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54366.exe
    3⤵
    PID:12720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64424.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64424.exe
    3⤵
    PID:17048
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22291.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22291.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56572.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56572.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52906.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13217.exe
        5⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40732.exe
        6⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10420.exe
        7⤵
        
        PID:12556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18795.exe
        7⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21930.exe
        6⤵
        
        PID:10692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61208.exe
        6⤵
        
        PID:14912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62735.exe
        6⤵
        
        PID:17572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63356.exe
        5⤵
        
        PID:7964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6886.exe
        5⤵
        
        PID:11504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62319.exe
        5⤵
        
        PID:13200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45651.exe
      4⤵
      PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8635.exe
        5⤵
        
        PID:8084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48376.exe
        6⤵
        
        PID:10944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41738.exe
        6⤵
        
        PID:7208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-140.exe
        5⤵
        
        PID:9336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53451.exe
        5⤵
        
        PID:15840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3935.exe
        5⤵
        
        PID:5304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38468.exe
      4⤵
      PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53716.exe
        5⤵
        
        PID:15788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25428.exe
        5⤵
        
        PID:8548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41697.exe
      4⤵
      PID:11408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37385.exe
      4⤵
      PID:17364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41592.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41592.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50934.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50934.exe
      4⤵
      PID:5388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65428.exe
        5⤵
        
        PID:7996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51500.exe
        6⤵
        
        PID:11596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-410.exe
        6⤵
        
        PID:14596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-140.exe
        5⤵
        
        PID:9268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17845.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36984.exe
      4⤵
      PID:7488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25050.exe
        5⤵
        
        PID:10412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18500.exe
        5⤵
        
        PID:14872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37820.exe
        5⤵
        
        PID:9712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1021.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29331.exe
      4⤵
      PID:16944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-593.exe
      4⤵
      PID:3272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6184.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6184.exe
    3⤵
    PID:6516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2003.exe
      4⤵
      PID:8472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-114.exe
      4⤵
      PID:12128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45438.exe
      4⤵
      PID:5504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53077.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53077.exe
    3⤵
    PID:9008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47998.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47998.exe
    3⤵
    PID:12512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54883.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54883.exe
    3⤵
    PID:17016
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16915.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16915.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1759.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1759.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7187.exe
      4⤵
      PID:6044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4250.exe
        5⤵
        
        PID:7096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9865.exe
        6⤵
        
        PID:12444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21972.exe
        6⤵
        
        PID:15808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46025.exe
        5⤵
        
        PID:10480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46818.exe
        5⤵
        
        PID:15244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6928.exe
        5⤵
        
        PID:17820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24156.exe
      4⤵
      PID:7528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12605.exe
        5⤵
        
        PID:11520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25298.exe
        5⤵
        
        PID:14544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27087.exe
      4⤵
      PID:7124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48250.exe
      4⤵
      PID:6488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44586.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44586.exe
    3⤵
    PID:7028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24775.exe
      4⤵
      PID:11076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16859.exe
      4⤵
      PID:15856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53031.exe
      4⤵
      PID:8148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62205.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62205.exe
    3⤵
    PID:9356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22061.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22061.exe
    3⤵
    PID:11696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7576.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7576.exe
    3⤵
    PID:6912
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35992.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35992.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3632.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3632.exe
    3⤵
    PID:6844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9979.exe
      4⤵
      PID:8416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12045.exe
        5⤵
        
        PID:8816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32402.exe
      4⤵
      PID:11952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61966.exe
      4⤵
      PID:6200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6755.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6755.exe
    3⤵
    PID:8972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47125.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47125.exe
    3⤵
    PID:13160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33737.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33737.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1332
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45440.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45440.exe
  2⤵
  PID:6256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31770.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31770.exe
    3⤵
    PID:1116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19404.exe
      4⤵
      PID:11724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21972.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52823.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52823.exe
    3⤵
    PID:10872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23483.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23483.exe
    3⤵
    PID:17076
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25165.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25165.exe
  2⤵
  PID:8568
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50250.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50250.exe
  2⤵
  PID:12316
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56527.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56527.exe
  2⤵
  PID:2272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1284,i,7447299413640964517,4240724842020506306,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:8
1⤵
PID:3208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 7124 -ip 7124
1⤵
PID:8092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 8228 -ip 8228
1⤵
PID:9900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 6724 -ip 6724
1⤵
PID:1928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 14708 -ip 14708
1⤵
PID:15020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 14644 -ip 14644
1⤵
PID:15336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 14504 -ip 14504
1⤵
PID:12828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 6724 -ip 6724
1⤵
PID:5448

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-16425.exe

Filesize
468KB

MD5
661ffbf8f83aa35174753abdc737e25a

SHA1
ec9fa3d672cfbd0f27bd2d2f3cdc87b021364824

SHA256
d7cde5e0a24c8c45eda91b2017061a99a6a85bd1e07ddc91902d7a03587e3d02

SHA512
67b08dd5c738e006dc322584fad15ca1cdd999cdc04a701540348372dfe143d8b6a7d5d7a6a8b76d52dd3e65532404484d47bffdcd6584c63b75e446832ed3e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16915.exe

Filesize
468KB

MD5
2d3288a407db5d63fc21c7f7fa6113f1

SHA1
93f373e26f8a38b391d83e894000d7262d726506

SHA256
932144f2639ad8cd5e5f18687cdbd085d094ec02b9010647951e4e93eb0af04d

SHA512
3b8ea2187491a7a9de6870241d745783e8a4e388d8ae587f62f5312f4c504cd7085ecbc29ca3395571fc2ec61fc9bc28b256aeb3484496fc33553df77ba95ffa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16964.exe

Filesize
468KB

MD5
5ea9b9ee8fd2484b4a43205f7662d179

SHA1
c9628bcaf39152a5f05c42b15950eec75e114610

SHA256
8881191a0d6d8d01896fca5a5bdd3166748cf8f817d55290ff365b0fad73e829

SHA512
6c91418f87693eab5792eb67873bac4f1526b1629703548a41f24a2818704de460e50c22622cc6d163b461cc826906eb5f1bd8018a79ad5a5fc3939cb45240a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2088.exe

Filesize
468KB

MD5
d300481b13c820271aa8a9ae5fab449d

SHA1
35d06f4d4f37a2084e00c4f8f7e2b69e5e382385

SHA256
7291daa3fe8a1650c15932a9d544936c2d663e81c63012d966fcda770f5909e4

SHA512
c1c0787b22574ea356d13a8ccb1f426009029129523f7e294e3e52a9af1ff44f300a374500c99844fb849175745bd5754caf4e0852726511faafbb80564ead5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21954.exe

Filesize
468KB

MD5
8e82cb38fa31c090fe82de7a4795ea7f

SHA1
638fe091112ca016f978b9615321e540d96d911a

SHA256
cca2fd1091adbdd1fedb6df5c22cd08f195649ab60041916f3aae4be957f645d

SHA512
de2e9a39cbcd8a025cc07e013395621bc5ab7b3b146ed6d6f0952bfd35c0720e32a930b9e794a5a1d57f3917f27ae49689adb8c60efaf250e04a7e9db7772568

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22291.exe

Filesize
468KB

MD5
01737a63a8510b2e049953c12f504ebe

SHA1
5e5d7c1dfcfe52899213f8ab1eeb61a8381da08f

SHA256
2813e4d967d388461bcbc3614d2fd00c83a54f37428fcb2f60ee5f91b105e10a

SHA512
f4030b59084e6aef54497fd8e3427bb0bbb11876d67bdc2013502656d562ec90439bbedb04667eeb8d06d3a5c473e43842484ded2e43e3cd6f5657d79bab7dfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22556.exe

Filesize
468KB

MD5
a49a78fac6664d46e46b10f3ff40a229

SHA1
96412fbffaa1d70d4aae791f29a301f352b67e3e

SHA256
71e0d4446ae381429010621465aebfcb6b8c81cd55a37f45d8d30c02df81de23

SHA512
f8b76557b9d73586187904920adef5dcc4f435e548dad5fc9d7755ec0d28052df354754f12e1327620259ed096b9aafbcb4a025c5f2b7452d4156a4d6988204a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23926.exe

Filesize
468KB

MD5
38b7407bdd0eedd80ad2ab787ac619df

SHA1
ecb9c040e2b597eaf3b43ba4d12efe4362b55498

SHA256
57d08a136d59077755b9d92354ff569132ca095d9a373e6d6a93fc8167edb959

SHA512
b03e3854d12602d5d8e0312e0ada1390cc279f508f0395de26134a4b62791856cdfe45a6a0470e55b54bd294cc46a24cdefa968e96eb0d163179a7f8228094e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24502.exe

Filesize
468KB

MD5
4bc64136c5ba8416bad02a86f7e16b26

SHA1
781147e61645adde8f5487a7daeaf01353eeb1d0

SHA256
ab29113ee33932764efd31e25ad49a700f645555ec59589408ef37c8e6327ec7

SHA512
8f5ac7a92ee66cad07b5fa132bf66ff7f56b1dbd6bec766ec2fd7a229dd56d19f0662371e6fad2acc4f0f991a4601d7a9d02061a5a6989cf84d2e95f7f3915db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25581.exe

Filesize
468KB

MD5
4c6d50c13952c273bf6971510ceb48f6

SHA1
877b87e995127a77d0052e617e8505e066028f84

SHA256
cde905e9957155a74a619ab4e2bfd3deef3d405412c0830ae870718b8a37d9b2

SHA512
0401139a14e5932601ec2b9bade8ed6b7a2448a5eeb4f172653bc638e73f258e80995680dc25d50c3e961b19a78d0baf134eac4ccd27e5fb81ab22542913846d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2690.exe

Filesize
468KB

MD5
bdc551e2f72508787adb08c4392a2d9a

SHA1
19c7e7499a36f7e10d4ae8b33b3a79091e24b433

SHA256
1cc10def326594c1787e6a9bd986545ee9a35143768a831a7769fef53ab82c79

SHA512
54554c474ba22d4f4aaf65c6afe7ba7c557d632a9a8dce21a39ba6e85e80e245eea80e8dff5d58ad62bad61b1ebc366144dc755b254368bc084598c94737106a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28620.exe

Filesize
468KB

MD5
ae799ff8ee3c6942b15df729ceef58a7

SHA1
c34941b2cc19dd644894ddeaf4e0641854374535

SHA256
0ea438746a6f1578d9d009a86585d06a2c3b9f03a9aad6fddfbee65f2386d4ef

SHA512
3393f0de09d8b9e71fef460a748953dd596755c54f0d3398a0f130aac80031a5de9f3a693ac606c22965ecdc7372b4353f787c498ab871556ae4dadf3c63f908

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28646.exe

Filesize
468KB

MD5
e31021dca21d023f8333a90b6ade8dc3

SHA1
ca21b4f139fd747c6b9686bf619b1b2576f0e795

SHA256
53b6e2e55fab0c24d0196f433fa8f12c6bc582000d97d3b063cdb955e5333e77

SHA512
8af904e4f84237f2ec9d5976251b81728dbb27d28956830c9ba32fe6549754202e297ca79b0d4f419cc8315765cfdbf400cd12c188097591e9674bc2fa8c55d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28730.exe

Filesize
468KB

MD5
bf9727de012ec6a8c80f730c8c26e8d9

SHA1
68577e3d7380a1762516856d1052c92a16f348dd

SHA256
5421826fc2135db1cb2f0a158e08d403fb9f8855fe9897c496e23171780b455c

SHA512
5dfde1e9e4a8c4dc69136ef5f2137603a5e58410b08e8243ef192e3f130831c0b09b5258f4054ed4fcd4956123d37ca5b0a488cc0af9c214cd095826f9fbfea6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29366.exe

Filesize
468KB

MD5
bfe7e99e4558a577c9625b9ba38c9a4c

SHA1
e6770ad82f7d5882e44c86e14df89c9477182bfe

SHA256
cebef77a20c66dd0d320369c4a45e58f501bf374c3a03fc770b795e35ec8ad09

SHA512
0ce4ad6b78de33b840412ad8e69dc6d41ca3d3924c7b484ce58b39a1394d114882f3a117dd65d94c6d961c7456622bd8027adaa5ccbb3248753978b127eac764

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29738.exe

Filesize
468KB

MD5
3be245a15d35d2a8da4a263dfcf65eb1

SHA1
504ec28b9f408358a5c2081df4cbba89a5ffb236

SHA256
98a46e9aabde42bd42ab7465f6664ea4e8acbce15ebcf05e9405f67515ab05dd

SHA512
6326fd47d863aeb4f09dfbf352fdabdef2d66ea447b18780dc3053ecbf63df32353cbe8d138cf8faf41aca1cd11ccf54c3bf7a2a171b32fd26e58af0565c3b38

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31225.exe

Filesize
468KB

MD5
19c64ca826cd6073ad18fdfc0ad54b57

SHA1
d1b75d778e94087f16c7232bf18a5cd5abce0554

SHA256
8a6f5c43a8d2841505108f4b9660b0345632724b0dc4237c4613fcee07b02164

SHA512
1e87423ef4219e161159d2e1fc804dcfe07a02f1f570dc2b76d3285d29ed6588736466c03a29f86b8ac35d91eb27eb2c77314a6924d9788dd26441f0e1d50fcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32670.exe

Filesize
468KB

MD5
b26ddf46ec8e91d8fc3226ad3fba1f64

SHA1
066a48ec270afa12f48395c8da7766030f90fd7e

SHA256
8f3c79e64e21e20ac421c27ede1486002023f90dc373fed296d0a3bd5f9fc471

SHA512
9d14e4c19d07e8ebf7cb845787adab9bf41de94e12e54bd2cc3a24e6ace87d7baac53c478636216c24eaaead5414e399f7e06c9caee105c0eacf59c9d3e16f6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33218.exe

Filesize
468KB

MD5
f70a951af75c6e90fd3673116e828c5d

SHA1
e16ccf5438c823c653cc3ffbfb0dd9fefcdee86e

SHA256
01a1c621b0bcde7dce1580ed16472853fb1696f9da3dd8e3a9cc13840524af44

SHA512
ec75b6db6f607cee1b4e8933a896b5e3cd0528622b6bd9d3a47ca1b113d386a4ededd9bea718942b35770e22ed1b85067fd6b80937b5fea77c258a7d0e28d51c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33822.exe

Filesize
468KB

MD5
a2131202ab1524734f26566acaa14206

SHA1
91229c950e97e43c12552d54aaa4e9968dc46171

SHA256
5e79418ab313c72635b468bf9956aa997c7778f2dcb8173b0390a1cd4d5bcba0

SHA512
8ba522fdeb3edd7030a1f60b281519e2aa39892a4dc86cd483d97faab9fd19c06115d3acd95e89f4a26a86f1503aa0495279dc5c2c7271fdde7453ed1d7ec997

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3393.exe

Filesize
468KB

MD5
3bf89b74910f74fb7f7f4d5995da4a1f

SHA1
0497c7caa5cf249f76d95779dd07d490e849a87a

SHA256
befafeb4bd5fe83b040bcffaebf0e3f338cc83d161540e9c37c08ae562a459c7

SHA512
5eafdc80abeecf254d860da8dd3f3948cd097ead0c197b1c8f4f4248f9035755d4f6e5a263c0f33ce22c1f9069154d0e82f2840a142e35ac247d85feb766286e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37356.exe

Filesize
468KB

MD5
8af505b87be8ab6e5fd2f33bb4951e85

SHA1
bbb60f807f57013a3c872db4a756a3b29afe81cb

SHA256
8de7b0cccdd835b31300754d47909f335d15d0c5719b35fc5f638918fc6b8ecd

SHA512
ff50492a8209c5fe31acc86cde5787fabfd4664b12a2f93b03837a5ad73adb7ad1863055f0469ae0b4be7f296d32f1c1872abd2da24335d881a622a69d652e3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39712.exe

Filesize
468KB

MD5
344ee9b2f9acaaad698f96c97aa2832d

SHA1
1b94a2793804b4aeab54322093dbd133c85a82fa

SHA256
bfe844a735935d4d10e9697fd232020e2b7a5ace4a758dc7984dd8fcef30ef8d

SHA512
c7cba185d2c0d1eabc361c4044dbcad53fa2882d0c7d0df1329e6bbcbfb8a56d819a2bb5191f2535d8e802d8d837d67a40040a0a996e148bec141a2e0988bac2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39860.exe

Filesize
468KB

MD5
3d66b3f443daad77805621e84b0939a0

SHA1
5ffcd8f4f95873c5b4db86ba8242e2738fc7a1d7

SHA256
7556564a38ec2a874624329413ca73329efb45514eb302f1c2aa4c354d0a0fd3

SHA512
0b754e2ed46051cd88ae9b1093bb0c8452130c6e4129c0e18ccce05ccd564e7c4e6ac2a2d56ff2727522ea152cd0bf1081cc35b723d029f5339059fda14e1355

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42954.exe

Filesize
468KB

MD5
eeacd59c3799b254e592538e71f1d6fe

SHA1
6c7e52b3c0c3e5a41aeffd0a41ee1317a62e1549

SHA256
314655cda379ed95d7417eab9332d6771bb3e6382f409fe2663060e0e7f6e119

SHA512
94011d41a051cfe63b3303ead625211ae1ea882d7d8b4afc2ea4bccc0c3aa90b82882c8e56a174c23c10b1193128cee916d5a82e8e76555d82021bbf2f68ba16

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44683.exe

Filesize
468KB

MD5
1f22085d6bce5fb39e3da58fb388e46d

SHA1
58ee144082fb48cac935422c9e244ab903decf54

SHA256
78dcf4075f8bc3e43d52f633eeca29383d2143aa1c5347c7c03cb4210ddb80e7

SHA512
1b5ac7a06cb29532064b1e4864252850a88d069c971ee433094b093f47a31c4d6a3b015acc191dc5261bbff8ede99b02ec70cb16bd1dfa10b796d30ce4ba7de6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48217.exe

Filesize
468KB

MD5
e257599caabe7f638b0322f2277fbf15

SHA1
3a30c86fb20909172534919faa9b26aa0600b4d0

SHA256
9c36a58af224aa24f140bc65373d96db6fec6858aa8697936834cba73ca49bee

SHA512
3b93b64d347ac7555a7355a8803d24c8faa1db46256e72c3a2668201c1e56bf5bb51080ad58a3f03b25b16f6614de3f81bd41e73690c36c631dc8ee6634f7423

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48596.exe

Filesize
468KB

MD5
6737abe0c9c79fcea7cc2d579213ec9f

SHA1
36b39e7fb30af15c3b9f8ea7925a54caff2eac8a

SHA256
a1370312f1387e45b08c8d3d77831adc7a5c1d68170a20bd88a2f40779d18671

SHA512
6c45f42d9c1871ff603271504fe2c26bb3c2a105c378d3c453a681fd325c493e761f1520395f55ba8d8b9c3cd98810731a955117d7c12be5582f2377580aa95d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50573.exe

Filesize
468KB

MD5
13f1e36c1014cc1fb75b8df9b2da7d79

SHA1
077d90f4f572d7cdad5732af8aeb9c717c1eaf5e

SHA256
f11f6bff2f5523533acfc423a52680590521104e4e5f9541c0139485777be5bf

SHA512
254ccd8392bef95ba3239c19bd95dfca0b4196476da48d7a3a7b30b63234bcecd3694e2777844e46705faa52d96c6329ebe6c277d039e14111154063e0a260ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52794.exe

Filesize
468KB

MD5
97357592836b24f8c78921f12d2e119f

SHA1
517eee0ac905d8fff92b7d18b1ce1134719c6c1f

SHA256
3d73d40dc8f971e05b7dfdd60af478877d6cfbbe58653c95f4883024a6f4b3bb

SHA512
f2d791286941bd68ca4c94dc4b4e682c949aba5a496b22401b0d1d9230e8ca782f4738031482a3b6bad68f30d0c08a6b4046ea87696aa8c3165291fcae74a932

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54526.exe

Filesize
468KB

MD5
329153fdc7a5b27f105de0388a993667

SHA1
23ac1309b99c3b68dd41bb71538329cbd0dcb800

SHA256
1af899b8c7df84c4b7d440b824f2a4391b49e063f66e68ae43060d9b01dfd4f6

SHA512
0358529545d13fe28e4760026df9257cbf243c95edc018e8204a59d86cff226e7c829b8b39e200d95b9ccf931c2bff3fbdaed21cb5403d6f154b4ed4ed933cc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55830.exe

Filesize
468KB

MD5
6a966661cace3b2fdc8e3ee51a598f40

SHA1
8591912f1b0822046a9944e69c062a9e2925308c

SHA256
2aa7ebaf1a8f4827c0da7649ede1cf55bca9416e9f86f7f1fba2538a2d1ef422

SHA512
ff609ca79ed4f28e63e82a40055067a1b78bcf2b242fbad148d1fae79de937e555f012089314cf31a4c93c6584bd08b0cfac0bf8db1f226f23bfccf524ea8456

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5617.exe

Filesize
468KB

MD5
09d3676980042e0ebc8f2c0d5ab98e1e

SHA1
586f9386b533eebedb42c7f050933ef515ee2b75

SHA256
d71ecd948fc58eb68647035d71691b2e5cac0bbf9ed54e405f4026a64673e707

SHA512
bd064cc0e42d9fba47211cfa2777da9efafac84308509c1567f491121e7801438920e58da0c8196449040b136e780826b1cb960419d2a21af4011777270e64ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56572.exe

Filesize
468KB

MD5
1b8f78b38be948362d0694583b7a7f53

SHA1
c715d99af8a82b779884dcb1d002a9c1f34e8282

SHA256
69565b3ea4cbc97159ba1f7a56d6d3b1db0302a180c9df9a6c198af6341d24e0

SHA512
58218336df93b8724d9354d76eaff408c1d86d5c5a4d92f36dfb1adbf775456b8df17129abd897008f6e86a6bbe73de8d9dff8729b81a5817771a0568b15ef4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58418.exe

Filesize
468KB

MD5
a2975e5a16e558622da7fe0542681e9b

SHA1
52402dda8edfc721727638317cb9922b7e65c00f

SHA256
7dff0ef01e6a1582f54aa0e90d41662898379d7ad5e4d1270746b4a73ba05e43

SHA512
cb6bd1d9df2cc1f558257540bd2e6cb98cbc1ad373464d9b91696671aa7a82c016a10f7448b3149cd9cd9b1f2e041d70d0ce1a3e045a388ba09096e58c51780b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62986.exe

Filesize
468KB

MD5
2ea81bf2996a805ddd8591a241d1f63f

SHA1
ecf297fa2338394740086ac6d4536db58aedc225

SHA256
b0d573cb8ff94ad834a0433c0e4c766b8ef632e463515d2c69ccc922be04af99

SHA512
0c5d7469ef037590e6615f90641d68ba864e04afc4e9e7e7c92d7ff4dcf963434bbff8dd7bf09a0246f9c48bce727acad9cfb5261580dd1649bff666621243b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6431.exe

Filesize
468KB

MD5
cea488aedf743cf7d08ff7baf068ad82

SHA1
35fe0b0eba6071beb3b4afe3032ccd91accd570f

SHA256
ced96ae4eb5d37a03839d0bbdf84458708afc55ef0823c8c6a60880808f78712

SHA512
9f757d0d3cf164344e8826aefa8cd57f3d6286fd5a0208440df52e0f437918e4482f9a45e88dc1a8e7e7765f0e9bf5b6922eb11cf0fccdcfc52a665e0197f589

Download Submit
memory/184-222-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/396-257-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/548-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/600-100-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/752-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1012-272-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1296-406-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1316-405-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1420-511-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1436-98-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1608-333-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1708-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1832-69-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1976-43-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2144-384-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2220-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2364-254-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2440-324-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2472-169-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2620-170-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2652-359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2704-267-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2720-383-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2796-129-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2804-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3056-145-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3068-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3184-418-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3232-99-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3268-187-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3296-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3376-195-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3500-189-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3532-123-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3532-2513-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3536-289-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3552-172-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3600-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3660-302-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3704-61-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3716-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3796-290-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3940-139-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4032-291-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4076-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4092-292-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4112-29-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4124-379-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4144-128-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4144-2512-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4176-45-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4232-224-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4276-309-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4348-2511-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4348-112-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4360-334-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4396-82-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4504-223-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4520-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4596-44-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4604-247-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4624-316-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4708-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4800-521-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4828-101-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4864-186-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4928-423-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4944-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5032-277-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5040-238-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5052-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5100-250-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5108-191-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5156-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5172-420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5204-419-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5224-421-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5248-407-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5296-416-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5328-417-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5336-549-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5376-537-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5388-551-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5516-548-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5576-577-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5592-431-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5656-461-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5664-459-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5672-460-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5708-462-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5716-578-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5744-463-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5852-474-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5920-473-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5952-503-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5964-504-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6028-508-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6052-509-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6124-507-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14708-2423-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14792-2491-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads